- Discuss - lists.centos.org

Re: [CentOS] General questions about security
by Ross S. W. Walker 01 Feb '08

01 Feb '08

Check to see if the town/county has any policies in place for computer systems and networks for public services and follow those guidelines. Otherwise look at surrounding public library systems to see if they have any you can adopt. For a LAMP setup your definitely going to want to use selinux to limit what each application can read and write to, and you should use audit too to set auditing on sensitive directories like, /etc, /bin, /lib, /sbin, /usr/bin, /usr/lib, /usr/sbin. You will probably want to use smartmon to monitor drive health and something else to monitor resource usage (drive space, memory, cpu, mysql db space) with email/sms alerts. -Ross ----- Original Message ----- From: centos-bounces(a)centos.org <centos-bounces(a)centos.org> To: CentOS mailing list <centos(a)centos.org> Sent: Fri Feb 01 06:47:36 2008 Subject: Re: [CentOS] General questions about security Les Bell a écrit : > Policy. It's a drag, writing policies, but without policies, you're in the > "Ready! Fire! Aim!" school of security. The top tier of policy is the > "Enterprise Security Policy", which establishes the security function, > roles, responsibilities, budget, etc. It also gives the power to enforce > penalties for breaches of policies. At the next tier, you have system- and > issue-specific policies, such as the "Use of corporate email" policy, the > "Inappropriate content in the workplace" policy. You may then move down to > standards (platforms, SOE, etc.) and procedures (e.g. for provisioning user > accounts, resetting passwords, etc.). <snip> Thanks for your very detailed response. Though I can't help feeling a bit like having asked for an identity photo... and getting a 10-foot oil painting :oD Basically, all I'm concerned about security-wise is a modest Apache/PHP/MySQL server running a single public library management software, and interconnecting eleven (small) public libraries, with a total of 60.000 database entries. No (very) big deal. The configuration is supposed to run on a dedicated server, so my question will be more practical: - Is it worth the hassle to bother with SELinux? - Is the standard firewall configuration enough, or do I really have to fine-tune the thing? - Basically, what auditing tools besides NMap can you recommend for such a thing? cheers, Niki _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.

2 1

Help with authenticating against Active Directory.
by Milton Calnek 01 Feb '08

01 Feb '08

Hello all, I'm trying to authenticate shell login's against an MS-ADS. I don't have admin access to the ADS, but I can talk to the admins. I have gotten as far as getting authentication working, but the uid's depend on the order of login. ie: the first guy to login gets 10000, the next gets 10001, etc. The problem I have with this is that I want to share the home directories via nfs, which means everyone has to have the same id. Is anyone else doing this? My smb.conf and nsswitch.conf files are below. TIA -- Milton Calnek BSc, A/Slt(Ret.) milton(a)calnek.com 306-717-8737 smb.conf [global] workgroup = example_com realm = example.COM server string = %h server (Samba %v) security = ADS map to guest = Bad Password passdb backend = tdbsam passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n . log level = 2 winbind:10 syslog = 0 log file = /var/log/samba/log.%m max log size = 1000 dns proxy = No wins server = ldap ldap ssl = no panic action = /usr/share/samba/panic-action %d idmap uid = 10000-20000 idmap gid = 10000-20000 idmap backend = ldap:ldap://ldap.example.com:3268 ldap admin dn = cn=Manager,dc=example,dc=COM ldap idmap suffix = ou=Idmap ldap suffix = dc=example,dc=COM template homedir = /home/%U template shell = /bin/bash winbind separator = + winbind use default domain = Yes winbind nested groups = Yes invalid users = root nsswitch.confpasswd: files compat winbind shadow: files compat group: files compat winbind #hosts: db files nisplus nis dns hosts: files dns # Example - obey only what nisplus tells us... #services: nisplus [NOTFOUND=return] files #networks: nisplus [NOTFOUND=return] files #protocols: nisplus [NOTFOUND=return] files #rpc: nisplus [NOTFOUND=return] files #ethers: nisplus [NOTFOUND=return] files #netmasks: nisplus [NOTFOUND=return] files bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: nisplus publickey: nisplus automount: files nisplus aliases: files nisplus -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

6 10

Unknown rootkit causes compromised servers
by Johnny Hughes 01 Feb '08

01 Feb '08

Here is the applicable article: http://www.linux.com/feature/125548 There are links in the above article that explain tests for the system and what is currently known about the rootkit. Apparently initial access is NOT via any vulnerability but just guessed root passwords. There are currently 2 methods to see if you are infected: 1. In some cases, the root kit causes you to not be able to create directories starting with a number ... so as root do: mkdir 1 If it gives you an error similar to this, you are probably infected: mkdir: cannot create directory `1': No such file or directory 2. Run this command for several minutes while you have windows users connecting to your web server: tcpdump -nAs 2048 src port 80 | grep "[a-zA-Z]\{5\}\.js'" If you get output from this script, you may be infected. ======================================================== More info: http://blog.cpanel.net/?p=31 http://www.cpanel.net/security/notes/random_js_toolkit.html http://www.finjan.com/Pressrelease.aspx?id=1820&PressLan=1819&lan=3 http://www.pcworld.com/article/id,141358-c,techindustrytrends/article.html http://www.webhostingtalk.com/showthread.php?t=651748 ========================================================== This does not seem to be caused by a specific vulnerability that CentOS or RHEL or cPanel has, but rather it seems to be caused by compromised root passwords. There are several recommendations in the above links to prevent becoming infected as well as what to do if you are infected. While there does not seem to be anything that the CentOS Development Team can "FIX" in relation to this issue ... I thought I would put the information out so that people can test their machines and take action as necessary. Thanks, Johnny Hughes

15 25

pxeos tool in system-config-netboot missing in CentOS
by vincenzo romero 01 Feb '08

01 Feb '08

Hello all, Since the "pxeos" utility is missing per Bug #0002304, http://bugs.centos.org/view.php?id=2304 which is required for me to setup a PXE server; which I'd like to in CentOS; Question: ... I am unable to find source for this; seems like the bug means that this was an oversight; perhaps the source is available somewhere and I can simply compile? If anyone is familiar where I can find this (a link/URL), a pointer would be greatly appreciated. -- best, Vince

1 0

swapping on centos 5.1
by Jerry Geis 01 Feb '08

01 Feb '08

Hi all, I used to use centos 4.5 on an AMD 4800+ with 2GIG ram. Now I use centos 5.1 on AMD 6400+ with 4GIG RAM. The system responsiveness is different between the two. I noticed that centos 5.1 seems to be swapping programs out of memory at times resulting in slowness (perceived by me). I played with swappiness (/proc/sys/vm/) setting to 10, then 1 then 0. Still resulted in the same perceived slowness. Today I did swapoff -a and now the system obviously does not swap anything out all all. I thought thats what swappiness of 0 would have done. Are others experiencing this also? The perceived slowness maks the older system with less RAM and slower CPU "seem" faster. Any suggestions on other things to try? Jerry

4 3

Re: [CentOS] General questions about security
by Les Bell 01 Feb '08

01 Feb '08

Niki Kovacs <contact(a)kikinovak.net> wrote: >> I wonder where to begin. << Policy. It's a drag, writing policies, but without policies, you're in the "Ready! Fire! Aim!" school of security. The top tier of policy is the "Enterprise Security Policy", which establishes the security function, roles, responsibilities, budget, etc. It also gives the power to enforce penalties for breaches of policies. At the next tier, you have system- and issue-specific policies, such as the "Use of corporate email" policy, the "Inappropriate content in the workplace" policy. You may then move down to standards (platforms, SOE, etc.) and procedures (e.g. for provisioning user accounts, resetting passwords, etc.). Everything then flows from a Threats and Risk Assessment. Identify the information assets of the enterprise, value them. Then identify the possible threats, essentially giving them a likelihood of occurring. This is then plugged into a risk matrix: high value asset with almost certain likelihood of compromise = extreme risk; insignificant value asset with rare likelihood of compromise = low risk. Obviously, you focus on the high risk stuff first. You then put in place controls to mitigate the risk. For some things, you can't mitigate (e.g. data centre hit by asteroid and now a smoking hole in the ground); those you push over into Disaster Recovery Planning and deal with through relocation, equipment replacement, off-site backups, etc. Your controls could be technical (firewalls, proxies, authentication and authorization/access control, etc.), physical (locked doors, fences, alarms) and administrative (policies/procedures/standards, pre-employment screening, job rotation, segregation of duties, etc.). ISO 27001/27002 are a good guide in this area, or if you're US Gummint, check out the NIST SP800-series publications. >> I would say first thing is get a series of "auditing" tools such as, for example, the port scanner nmap, to test the firewall on the server. Any other ideas for that? << Actually, tools like nmap, Nessus, etc. come in quite late in the day, for assurance that things are configured correctly. You can usually get much better bang from the buck from an internal audit first (it's amazing how often things are documented as being one way, when actually they're configured a completely different way). >> Maybe some good reads on security? That is, articles that don't require you to be a doctor in computer science to get a grasp of the subject? << If you want a rapid overview of Linux security, I recommend the book "Real World Linux Security" by Bob Toxen. If you want a rapid overview of the business aspects of security, I'd recommend you investigate Security+, which is an entry-level security certification - a course or even just a study guide would help you. I'll let others comment on SELinux - I've worked with it, but my experience is definitely atypical. A closing quote, which I think comes from the old edition of the "Official (ISC)² Guide to the CISSP CBK", but is probably the key point: "Technical specialists are not the right people to decide how the organization approaches security and what security measures should be implemented. Companies which deal with security at the administrator level do not view security in broad enough terms. Senior management is not sufficiently involved and aware, proper risk management is not performed, security is under-funded and there is no planning and procedures to deal with unanticipated events." In other words, your top priority in security should be to obtain senior management backing. Without that, you'll just be spinning your wheels. And always remember: you can secure the technology fairly easily - it's the *people* that are the weakest link. Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

3 2

Re: [CentOS] General questions about security
by Les Bell 01 Feb '08

01 Feb '08

Niki Kovacs <contact(a)kikinovak.net> wrote: >> Thanks for your very detailed response. << Trust me when I say: that wasn't detailed. Nowhere near it. >> - Is it worth the hassle to bother with SELinux? - Is the standard firewall configuration enough << You can go light on all that policy stuff, especially in a small business environment, but you need to give it at least superficial consideration. Until you do, you can't answer those questions, and we certainly can't. Would, say, a web site defacement cause your organization significant embarrassment? Would it cost you your job? Could borrowers' personal information be compromised? Are you storing information like SSN's? At what point does the benefit exceed the costs? The hassle is worth it for defense/government applications involving classified data, obviously. Probably not worth it for a web-surfing home desktop. You're somewhere - where? - in between. Only you can know, and it depends on business considerations. Remember: "Ready! Fire! Aim!". One easy out: the "due diligence" approach. Find out what other libraries are doing, and do the same or better. The Koha, OpenBiblio and other mailing lists could be a help here. I'll let others clue you in on various web vulnerabilities - SQL injection, command injection, cross-site scripting, overflows, etc. - as well as tools like Nessus, Nikto, etc. for vuln scanning. However, your top priority here should be proactive patch management and intrusion detection techniques such as log file monitoring/analysis. Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

1 0

General questions about security
by Niki Kovacs 01 Feb '08

01 Feb '08

Hi, I admit I never gave security that much thought, that is, except the most basic security rules like choosing good passwords, or reasonable file and directory permissions. But now I have to change that, since I'll soon have to setup a dedicated production server for our public libraries. I wonder where to begin. I would say first thing is get a series of "auditing" tools such as, for example, the port scanner nmap, to test the firewall on the server. Any other ideas for that? The firewall: CentOS includes a default firewall, where ports can be chosen using a simple graphical (or ncurses) tool. Is that solid enough for a web server? Or do you recommend diving into the innards of iptables? Or maybe, other solution, can you recommend some good "reasonable" set of rules for a web server, for example? Last but not least: SELinux. For the moment I don't use it. I read the chapter on SELinux in "Red Hat Enterprise Linux 5 Unleashed" by Tammy Fox, and I simply wonder if it's worth the pain. I'm curious about your opinions about this subject. Maybe some good reads on security? That is, articles that don't require you to be a doctor in computer science to get a grasp of the subject? And also documentation that doesn't require me to have a life expectance of 500+ years :oD Any suggestions? Niki

2 1

loopback network device
by Jordi Prats 01 Feb '08

01 Feb '08

Hi all, It's possible to create an alias of a device? Something like a device loN that all it's traffic is send to ethN, so ethN and loN are equivalent. It's for a bridged setup, i'm not trying to setup another IP on a device. Thanks! Jordi -- ...................................................................... __ / / Jordi Prats C E / S / C A Dept. de Sistemes /_/ Centre de Supercomputació de Catalunya Gran Capità, 2-4 (Edifici Nexus) · 08034 Barcelona T. 93 205 6464 · F. 93 205 6979 · jprats(a)cesca.es ......................................................................

2 1

rsync and swapping
by Jerry Geis 01 Feb '08

01 Feb '08

hi all, I use rsync to copy/backup ALL my stuff to another disk. When I run this seems like my machine (4 GIG ram centos 5.1) now begins to swap out more programs. Is there a way to reduce that swapping? I am running with echo 1 > /proc/sys/vm/swappiness I simply mount /dev/sdc1 /mnt/backup; mkdir /mnt/backup/month.day.year then rsync -a /home /mnt/backup/mon.day.year This is approximately 102G of data. Thanks for any suggestions. Jerry

14 20

Problems to install java plugin in CentOS 5.1 x86_64
by Sergio Belkin 01 Feb '08

01 Feb '08

Hi! I've tried to install java plugin as is in http://www.howtoforge.com/installation-guide-centos5.1-desktop-p7 but with no success. All steps seems to go well, with no error messages, but Firefox says that there is no java plugin. Please, tell me what could be wrong? Thanks in advance!! -- Sergio Belkin ----------------------------------------

3 5

centosplus + priority plugin
by Christopher Chan 01 Feb '08

01 Feb '08

I have a Centos 4 box that has been updated all the way to 4.6 without using the centosplus repository. Now I want to use the centosplus repository for Centos 4 to get the latest LAMP, mod_perl, perl and other perl modules so that I can install rt 3.6.6 and its necessary modules. However, for some reason, the latest perl package in the centosplus repository does not appear on the radar when I run yum check-update. Has anybody ran into this and get around the problem? Contents of yum.conf and Centos-Base.repo and output from yum check-update follow. Christopher cat /etc/yum.conf [main] cachedir=/var/cache/yum debuglevel=2 logfile=/var/log/yum.log pkgpolicy=newest distroverpkg=centos-release tolerant=1 exactarch=1 retries=20 obsoletes=1 gpgcheck=1 plugins=1 exclude=postfix* cyrus-sasl* dovecot* -------------------------------------------------------------------- cat /etc/yum.repos.d/CentOS-Base.repo # CentOS-Base.repo # # This file uses a new mirrorlist system developed by Lance Davis for CentOS. # The mirror system uses the connecting IP address of the client and the # update status of each mirror to pick mirrors that are updated to and # geographically close to the client. You should use this for CentOS updates # unless you are manually picking other mirrors. # # If the mirrorlist= does not work for you, as a fall back you can try the # remarked out baseurl= line instead. # # [base] name=CentOS-$releasever - Base #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os baseurl=http://ftp.hostrino.com/pub/centos/$releasever/os/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 exclude=php* httpd* postgres* MySQL* mysql* perl perl-DBD-MySQL perl-DBD-Pg perl-DBI perl-suidperl unixODBC* mod_auth_mysql mod_auth_pgsql mod_perl mod_perl-devel mod_ssl priority=1 #released updates [update] name=CentOS-$releasever - Updates #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates baseurl=http://ftp.hostrino.com/pub/centos/$releasever/updates/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 exclude=php* httpd* postgres* MySQL* mysql* perl perl-DBD-MySQL perl-DBD-Pg perl-DBI perl-suidperl unixODBC* mod_auth_mysql mod_auth_pgsql mod_perl mod_perl-devel mod_ssl priority=1 #packages used/produced in the build but not released [addons] name=CentOS-$releasever - Addons #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=addons baseurl=http://ftp.hostrino.com/pub/centos/$releasever/addons/$basearch/ gpgcheck=1 enabled=0 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 #additional packages that may be useful [extras] name=CentOS-$releasever - Extras #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras baseurl=http://ftp.hostrino.com/pub/centos/$releasever/extras/$basearch/ gpgcheck=1 enabled=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 #additional packages that extend functionality of existing packages [centosplus] name=CentOS-$releasever - Plus #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus baseurl=http://ftp.hostrino.com/pub/centos/$releasever/centosplus/$basearch/ gpgcheck=1 enabled=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 priority=2 #contrib - packages by Centos Users [contrib] name=CentOS-$releasever - Contrib #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib baseurl=http://ftp.hostrino.com/pub/centos/$releasever/contrib/$basearch/ gpgcheck=1 enabled=0 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 ---------------------------------------------------------------- yum check-update Loading "priorities" plugin Setting up repositories Reading repository metadata in from local files Excluding Packages in global exclude list Finished Excluding Packages from CentOS-4 - Updates Finished Excluding Packages from CentOS-4 - Base Finished 43 packages excluded due to repository priority protections httpd.x86_64 2.0.59-1.el4s1.10.el4. centosplus httpd-manual.x86_64 2.0.59-1.el4s1.10.el4. centosplus mod_perl.x86_64 2.0.3-1.el4s1.3 centosplus mod_ssl.x86_64 1:2.0.59-1.el4s1.10.el centosplus mysql.x86_64 5.0.54-1.el4.centos centosplus mysql-devel.x86_64 5.0.54-1.el4.centos centosplus mysql-server.x86_64 5.0.54-1.el4.centos centosplus mysqlclient10.x86_64 3.23.58-9.2.c4 centosplus perl-DBD-MySQL.x86_64 3.0008-1.el4.centos centosplus perl-DBD-Pg.x86_64 1.49-1.el4s1 centosplus perl-DBI.x86_64 1.54-1.el4s1 centosplus php.x86_64 5.1.6-3.el4s1.8 centosplus php-gd.x86_64 5.1.6-3.el4s1.8 centosplus php-ldap.x86_64 5.1.6-3.el4s1.8 centosplus php-mbstring.x86_64 5.1.6-3.el4s1.8 centosplus php-pear.noarch 1:1.4.11-1.el4s1.1 centosplus php-pgsql.x86_64 5.1.6-3.el4s1.8 centosplus postgresql.x86_64 8.1.9-1.el4s1.1 centosplus postgresql-devel.x86_64 8.1.9-1.el4s1.1 centosplus postgresql-libs.x86_64 8.1.9-1.el4s1.1 centosplus postgresql-server.x86_64 8.1.9-1.el4s1.1 centosplus unixODBC.x86_64 2.2.12-1.el4s1.1 centosplus

2 3

VMWare 6.02 and Linux screen saver?
by Scott Ehrlich 31 Jan '08

31 Jan '08

I have a user who freshly installed CentOS on their desktop. They also installed VMWare 6.02. When they click the mouse on their Linux desktop, the screen saver properly activates. But, when they click the mouse in their VMWare session, the Linux screen saver never activates. This has been tried for both VMWare Player and Workstation. I don't know if it makes any difference, but the VMWare Guest OS is Windows XP w/SP2. Thanks for any insight. Scott

2 1

adaptec 2100S drivers
by Mark Weaver 31 Jan '08

31 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I've got a server that I'm rebuilding and I've been given an Adaptec 2100S single channel scsi card to use. Problem is I can't find drivers for CentOS 4 anywhere. So far I've tried the adaptec drivers on the install CD but when it comes time to use disc druid it doesn't see the array that I've setup. don't know if it matters, but I've got the CDROM on IDE0 port and nothing on IDE1 port. Are there drivers for this scsi card anywhere? thanks, - -- Mark "If you have found a very wise man, then you've found a man that at one time was an idiot and lived long enough to learn from his own stupidity." ============================================== Powered by CentOS5 (RHEL5) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: GnuPT 2.5.8.1 by EQUIPMENTE.DE iD8DBQFHoNHkXIpLU+e4OpgRAgltAKCVRlOlrtXSHz4ptqeEVV58rGsEDACgkwzN f1RNeKUBfq8AaISTe5KFIPM= =+MVB -----END PGP SIGNATURE-----

2 1

About Creating a DVD iso from Cd's isos
by Manuel Enrique Chavez Manzano 31 Jan '08

31 Jan '08

I had tried the bash script that there is on the wiki about How to create a DVD from Cd's I got no errors during the making of the DVD but the size of the final DVD.iso is about 2.2 Gb when I look into the mirrors page a DVD iso is about 4 gb Is theiso size correct?, or I'm doing something wrong???

1 0

Where is gpg-agent?
by Anne Wilson 31 Jan '08

31 Jan '08

The only obstacle now to running this box as the mail server is that I do read and send mail on it occasionally, while working on something. I need gpg-agent, but can't find how to get it. Is it merged into another package, or do I simply have to look at other repositories? Anne

3 7

Locating the broken links
by Ioannis Vranos 31 Jan '08

31 Jan '08

Is there any command that I can use to find the broken links that point to non-existent files? Thanks a lot.

7 10

ISCSI help
by Plant, Dean 31 Jan '08

31 Jan '08

I am fairly new to ISCSI and SAN technology but having recently invested in the technology I am trying to find out exactly what can and can not be manipulated, filesystem wise, without requiring a reboot. I am using the inbuilt software ISCSI initiator and multipathing in CentOS 5.1. My steps so far. Create 10GB volume on SAN # iscsiadm -m session -R # fdisk /dev/mapper/mpath0 # kpartx -a /dev/mapper/mpath0 # mke2fs -j /dev/mapper/mpath0p1 # mount /dev/mapper/mpath0p1 /test-mount <--works fine to here--> Now I want to extend the volume on the SAN to 15GB run fdisk and use resize2fs to extend the filesystem, is this possible without a reboot? Currently, I don't seem to be able to get fdisk to see the new disk size after extending the volume. I know this can be done using LVM if I created 2 volumes rather than extending but I am curious to know if it can be done without LVM. Any other tips about what can be done with ISCSI would be welcome. Thanks Dean

3 2

No route to host
by horas simalango 31 Jan '08

31 Jan '08

Dear Mr/Mrs/Ms, I have e-mail server using Centos 4.1 So far I can send and receive e-mail using this server, but why to this address: retna(a)pttropical.co.id can not send? Every time I send e-mail to above address my server always respon with this massage: ----- Transcript of session follows ----- <retna(a)pttropical.co.id>... Deferred: mail.pttropical.co.id.: No route to host Warning: message still undelivered after 4 hours Will keep trying until message is 5 days old Please help me solve this problem! Previously Thank yuo for your help. Regards, Horasima SML.

2 1

NoMachine NX Server
by Sobari Tanuwijaya 31 Jan '08

31 Jan '08

Hi, Is there anybody ever have an experience install NoMachine NX Server on centos? Is there anything need to get special attention? Thanks in advance -- Tanu --

4 4

Re: [CentOS] No route to host
by Les Bell 31 Jan '08

31 Jan '08

Bill Campbell <centos(a)celestial.com> wrote: >> Most likely there was a temporary problem connecting to their server. I was just able to ping mail.pttropical.co.id, their only listed MX server. << Yep. And telnetting to port 25 gives a connection. Looks OK now: telnet mail.pttropical.co.id 25 Trying 203.130.193.106... Connected to mail.pttropical.co.id (203.130.193.106). Escape character is '^]'. QUIT Connection closed by foreign host. Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

1 0

Re: [CentOS] No route to host
by Les Bell 31 Jan '08

31 Jan '08

"horas simalango" <horasima(a)gmail.com> wrote: >> Please help me solve this problem! << The commands you'd use to diagnose this problem are: dig pttropical.co.id SOA (That works fine) dig pttropical.co.id MX (That works, and shows mail.pttropical.co.id as their MX) traceroute mail.pttropical.co.id (Which bombs out. Ergo their mail server or an upstream router or link is down). Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

3 2

Network routes
by Jason Pyeron 31 Jan '08

31 Jan '08

I am unable to ping NE.TW.RKB.IP1 from an outside network. Other machines which do not have access or routes for NET.WOR.KA.0 respond just fine. How do I get it to respond on both NET.WOR.KA.0 and NE.TW.RKB.0 given all default traffic should go through NET.WOR.KA.1 unless it is in reply to traffic from NE.TW.RKB.1 or there is an outage. [root@host20 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface NET.WOR.KA.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 NE.TW.RKB.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1 0.0.0.0 NET.WOR.KA.1 0.0.0.0 UG 0 0 0 eth1 0.0.0.0 NE.TW.RKB.1 0.0.0.0 UG 20 0 0 eth0 [root@host20 ~]# ifconfig eth0 Link encap:Ethernet HWaddr 00:17:31:0F:04:AE inet addr:NE.TW.RKB.IP1 Bcast:NE.TW.RKB.255 Mask:255.255.255.0 eth0:pn Link encap:Ethernet HWaddr 00:17:31:0F:04:AE inet addr:192.168.1.20 Bcast:192.168.1.255 Mask:255.255.255.0 eth1 Link encap:Ethernet HWaddr 00:01:03:E9:42:D0 inet addr:NET.WOR.KA.IP2 Bcast:NET.WOR.KA.255 Mask:255.255.255.0 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 TIA -jason -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Sr. Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, purge the message from your system and notify the sender immediately. Any other use of the email by you is prohibited.

4 7

No route to host
by horas simalango 31 Jan '08

31 Jan '08

Dear Mr/Mrs/Ms, I have e-mail server using Centos 4.3 So far I can send and receive e-mail using this server, but why to this address: retna(a)pttropical.co.id can not send? Every time I send e-mail to above address my server always respon with this massage: ----- Transcript of session follows ----- <retna(a)pttropical.co.id>... Deferred: mail.pttropical.co.id.: No route to host Warning: message still undelivered after 4 hours Will keep trying until message is 5 days old Please help me solve this problem! Previously Thank yuo for your help. Regards, Horasima SML.

1 0

yum fails with invalid dependency on sqlite
by Yusuf Goolamabbas 31 Jan '08

31 Jan '08

Hi, I am using Centos 4.6 on x86-64. recently when I tried to do a yum -y check-update this is the output I get [root@amd64 ~]# yum check-update Setting up repositories update 100% |=========================| 951 B 00:00 base 100% |=========================| 1.1 kB 00:00 addons 100% |=========================| 951 B 00:00 Reading repository metadata in from local files primary.xml.gz 100% |=========================| 74 kB 00:01 (process:1999): GLib-CRITICAL **: file gtimer.c: line 106 (g_timer_stop): assertion `timer != NULL' failed (process:1999): GLib-CRITICAL **: file gtimer.c: line 88 (g_timer_destroy): assertion `timer != NULL' failed Traceback (most recent call last): File "/usr/bin/yum", line 29, in ? yummain.main(sys.argv[1:]) File "/usr/share/yum-cli/yummain.py", line 97, in main result, resultmsgs = do() File "/usr/share/yum-cli/cli.py", line 534, in doCommands ypl = self.returnPkgLists() File "/usr/share/yum-cli/cli.py", line 1176, in returnPkgLists ypl = self.doPackageLists(pkgnarrow=pkgnarrow) File "__init__.py", line 904, in doPackageLists File "/usr/share/yum-cli/cli.py", line 75, in doRepoSetup self.doSackSetup(thisrepo=thisrepo) File "__init__.py", line 260, in doSackSetup File "repos.py", line 277, in populateSack File "/usr/lib64/python2.3/site-packages/sqlitecachec.py", line 40, in getPrimary self.repoid)) TypeError: Can not create index on requires table: near "NOT": syntax error This is the output of rpm -qa | grep sqlite [root@amd64 ~]# rpm -qa | grep sqlite python-sqlite-1.1.7-1.2.1 sqlite-3.3.6-2 sqlite-devel-3.3.6-2 any suggestions ?

2 2

Re: [CentOS] centos 5.0/5.1 nfs kickstart
by Paul Armor 30 Jan '08

30 Jan '08

Hi, On Tue, 29 Jan 2008, Adam Miller wrote: > According to these docs an MTU can be specified in the kickstart script. It > doesn't say much more than that though. > > http://www.centos.org/docs/5/html/Installation_Guide-en-US/s1-kickstart2-op… > > The reason for nfs and an mtu of 4500 is complicated and not in my control. > This is being used in a beowulf cluster environment. > > The process I'm following is currently working for kickstarting Fedora Core 4 > installs, so I am hopeful it will work in centos. > > Adam Getting this thread back on track... The problem seems to be that when syslinux hands over control to the anaconda image, anaconda (specifically /sbin/loader) blows away the mtu... I'm guessing that it actually does set the mtu, then resets the interface (in our case, a broacom 5704 using tg3) and thus instantly forgets the mtu change. If in the syslinux kernel args I pass a static ip/netmask/mtu to the kernel, it works appropriately. Oddly, when starting the kickstart, after the ks.cfg file it will dhcp AND it seems remember the mtu setting. Thanks, Paul

1 0

Apache: User and Group
by Niki Kovacs 30 Jan '08

30 Jan '08

Hi, I'm currently setting up a simple web server. So far, everything (PHP, MySQL) works very well, but I admit I never gave security that much thought. Time to change that habit. First things first. The RHEL Deployment Guide lists Apache's configuration directives alphabetically. Instead of going through them from A to Z, I'll try to start with what seems more important, and then advance step by step. User apache Group apache As far as I understand, I have to chown all my web content accordingly, so that everything below /var/www/html belongs to apache:apache. Right? cheers, Niki

4 4

Dump on remote filesystems?
by Scott Ehrlich 30 Jan '08

30 Jan '08

I have a couple C5 systems I want to back up. My plan is to, one way or another, back them up to a C5 machine in my office. I have samba installed on the systems to back up, the machines are mounted on the system in my office, and a tape library hanging of the system in my office. I was hoping to perform a simple /sbin/dump of the remote systems. I put together a script for another successful backup I have going on a system with local filesystems. But for remote filesystems, I get errors of File Cannot Be Accessed (//remote_system/subdir) which does exist as an smb mounted filesystem. I'd use NFS, but I would like a bit more control and some level of encryption for the user authentication and data being transferred. If a direct dump of remote smb filesystems isn't possible, I may opt to have each system perform their own local dumps, then run a script locally on the tape-connected machine to dump those local dumps, or copy the dumps locally then dump them to tape. If nothing else works, I can always install Windows XP and use Windows backup program, but I'd really like to try and get this going under Linux before going that route. Thanks for insights. Scott

9 10

Question on http stop responding
by Jerry Geis 30 Jan '08

30 Jan '08

I have a machine centos 5.1 fully up to patch that is on a network that has other machines that takes credit cards. In such an environment I have found that there is something called PCI - Payment Card Industry standards. They are scanning my machine to make sure it is OK to be on this network. One of the faults coming back is "Web server stops responding" to 3 consecutive HTTP attempts Is this a setting in http? Anyone familiar with this? Thanks, Jerry

2 1

snort question
by Alex 30 Jan '08

30 Jan '08

has anyone gotin snort 2.x working on centos 5.1 thanks in advance for your time

1 0

Resizing a fat filesystem on a USB partition
by Dogsbody 30 Jan '08

30 Jan '08

Hi All, I feel this is the most simple question but I am currently going around and round in circles and searches keep bringing me up Windows tools!! :-( I have a 512MB USB drive that has a 12MB FAT16 partition on it. How can I resize this 12MB partition to grow and fill the whole 512MB drive? Just in case I am being stupid, here is what I am doing... :-) I would like a quick USB drive that a machine can boot from but will then load and run some custom tools we have. I have done a... dd if=/mirrors/centos/5/os/i386/images/diskboot.img of=/dev/sda ... which gives the 12MB partition but now I want to grow it so I can then add my own apps. Thank you very much in advance Regards, Dan

3 5

Command limiting with SSH keys and password auth ...
by Ian 30 Jan '08

30 Jan '08

Hi all, I'm trying to do a setup (Centos 4.4), with ssh keys. Ideal is that remote you can enter a limited set of commands with no password "or" you can ssh in with password and get a normal bash prompt. At the moment I have from="::ffff:x.x.x.x",command="/usr/local/bin/allowedcommands.sh" ssh-rsa <restofkey> (allowed commands I do checks for which ones are allowed and will add anything dodgy to check for) in authorized_keys2. This all works with the keys I have, I can do an ssh <server> ls for example (ls being allowed), which works, otherwise it returns nothing if not allowed command is given. Main problem I have is if you enter no command (simply ssh <server>) it also kicks you out, I'd like it to ask for a password if no command is given, and then if correct pass you onto a normal shell. Is such a thing possible, or other avenues to get to the same point ? Thanks in advance, Ian

2 1

RHEL / CentOS Kernel Updates
by Manish Kathuria 30 Jan '08

30 Jan '08

How are the updated kernels released by Red Hat / Cent OS related to the latest vanilla kernels ? Are the changes, new features and drivers, etc. available in the newer kernels also ported to the updated kernels released by Red Hat in their entirety ? For the lifetime of a distribution like RHEL 4 or RHEL 5, Red Hat would stick to the same major and minor number of the kernel and would just change release numbers. What is the relation, if any, between the new kernels and the updates released by Red Hat ? Thanks, -- Manish Kathuria Tux Technologies http://www.tuxtechnologies.co.in/

6 11

How can i share my WAN ip to my LAN?
by Tolun ARDAHANLI 30 Jan '08

30 Jan '08

Hi everybody... How can I share my WAN ip to my LAN? How can I do that I really dont know...:( I am using linux long time ago but this kind I would like to do newly... Can anybody help me about IP sharing in Centos? thanks alot... -- Tolun ARDAHANLI Bilgisayar Muhendisi E-posta:tolun.ardahanli@linux.org.tr Icq:326600 ---------------------------------------------------------------------------- Tolun ARDAHANLI Computer Engineer E-mail:tolun.ardahanli@linux.org.tr Icq:326600

10 22

Bonding two network cards
by Joseph L. Casale 30 Jan '08

30 Jan '08

I am searching the net for instructions on how to do this in CentOS 5.1 but am not 100% sure I am finding a reliable doc. I am doing this remotely and don't have much room for error:) Can anyone point me along here? Thanks! jlc

3 4

Re: [CentOS] Re: Network routes
by Ross S. W. Walker 30 Jan '08

30 Jan '08

Sorry for the top post. The default route is the route applied when no other route matches the destination IP. From that how would you figure out which default route to pick, only if the routes were weighted could you pick between two. If you had two routes with equal weight and the traffic went round robin between them then the originating host will discard half the returning traffic because it's not coming from the same ip it sent it to. No your best bet is probably to do reverse NAT'ing as it is simple to setup and you don't have to worry about default routes and weight. Traffic initiates on 1 gateway and sticks with it for the duration of the session. You can use BGP on the gateways outside interface to load balance or fail-over the default gateway or use round-robin DNS, MX records for mail, etc. -Ross ----- Original Message ----- From: centos-bounces(a)centos.org <centos-bounces(a)centos.org> To: centos(a)centos.org <centos(a)centos.org> Sent: Tue Jan 29 18:03:13 2008 Subject: [CentOS] Re: Network routes on 1/29/2008 2:53 PM Jason Pyeron spake the following: > > >> -----Original Message----- >> From: centos-bounces(a)centos.org >> [mailto:centos-bounces@centos.org] On Behalf Of Ross S. W. Walker >> Sent: Tuesday, January 29, 2008 17:38 >> To: CentOS mailing list >> Subject: RE: [CentOS] Network routes >> >> Jason Pyeron wrote: >>> I am unable to ping NE.TW.RKB.IP1 from an outside network. >>> Other machines >>> which do not have access or routes for NET.WOR.KA.0 respond >> just fine. >>> How do I get it to respond on both NET.WOR.KA.0 and >>> NE.TW.RKB.0 given all >>> default traffic should go through NET.WOR.KA.1 unless it is >>> in reply to >>> traffic from NE.TW.RKB.1 or there is an outage. >>> >>> [root@host20 ~]# route -n >>> Kernel IP routing table >>> Destination Gateway Genmask Flags Metric >>> Ref Use >>> Iface >>> NET.WOR.KA.0 0.0.0.0 255.255.255.0 U 0 >>> 0 0 eth1 >>> 192.168.1.0 0.0.0.0 255.255.255.0 U 0 >>> 0 0 eth0 >>> NE.TW.RKB.0 0.0.0.0 255.255.255.0 U 0 >>> 0 0 eth0 >>> 169.254.0.0 0.0.0.0 255.255.0.0 U 0 >>> 0 0 eth1 >>> 0.0.0.0 NET.WOR.KA.1 0.0.0.0 UG 0 >>> 0 0 eth1 >>> 0.0.0.0 NE.TW.RKB.1 0.0.0.0 UG 20 >>> 0 0 eth0 >>> >>> [root@host20 ~]# ifconfig >>> eth0 Link encap:Ethernet HWaddr 00:17:31:0F:04:AE >>> inet addr:NE.TW.RKB.IP1 Bcast:NE.TW.RKB.255 >>> Mask:255.255.255.0 >>> eth0:pn Link encap:Ethernet HWaddr 00:17:31:0F:04:AE >>> inet addr:192.168.1.20 Bcast:192.168.1.255 >>> Mask:255.255.255.0 >>> eth1 Link encap:Ethernet HWaddr 00:01:03:E9:42:D0 >>> inet addr:NET.WOR.KA.IP2 Bcast:NET.WOR.KA.255 >>> Mask:255.255.255.0 >>> lo Link encap:Local Loopback >>> inet addr:127.0.0.1 Mask:255.0.0.0 >>> >> You can have only 1 default route. >> >> You can use RIP or some other routing protocol to >> advertise defualt routes to the host from the >> gateways based upon route availability or weight, >> or you can deploy reverse NAT'ing on the gateways >> so external IPs will be masqueraded as the >> internal IP of the gateway and thus be routed to >> the appropriate gateway based on which IP they >> arrived on. >> >> -Ross >> > > But I have 2 physical network cards, on 2 different networks. Should they > not both have default routes? > You would think so, but it will confuse the system so bad that traffic won't know where to go. The default route is the route that packets need to take to leave your network to enter the outside world. Every thing under your control should have static routes of some kind, or a routing daemon. -- MailScanner is like deodorant... You hope everybody uses it, and you notice quickly if they don't!!!! ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.

2 2

Re: [CentOS] Resizing a fat filesystem on a USB partition
by Ross S. W. Walker 30 Jan '08

30 Jan '08

Look for gnu parted. There are a couple of live cds out there with it, like "Parted Magic" and others. Parted can resize fat and ntfs file systems among others. -Ross ----- Original Message ----- From: centos-bounces(a)centos.org <centos-bounces(a)centos.org> To: CentOS mailing list <centos(a)centos.org> Sent: Tue Jan 29 17:53:07 2008 Subject: Re: [CentOS] Resizing a fat filesystem on a USB partition > AFAIK, there is no way to "resize" any FAT partition. You have to > delete both partitions and then create a new one. I thought the CD installer came with a utility to resize FAT partitions (albeit in MS DOS)? And this isn't possible in CentOS it self? :-/ Ho hum, thank you very much for the quick answer :-) Dan _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.

3 2

Duplex Printing
by Clint Dilks 29 Jan '08

29 Jan '08

Hi People, This may be slightly off topic if so please let me know. My situation is I have a bunch of Fedora clients connecting to a CentOS Printer server (setup using cups). I have gone through and used Vendor supplied ppd files where possible. And basic printing is working. But, Duplex printing doesn't. The Printers I am using are mostly Brother / HP with a few MFD's from Konica Minolta. I have configured Duplexing information on both the Printer Server and the Clients but no matter what options are set jobs always come out single sided. The only successful Duplex Job I have been able to print was by using * enscript -DDuplex:true -P mfd_scmsoffice test.txt *Otherwise I have been trying *lp -d mfd_scmsoffice -o sides=two-sided-long-edge test.txt* The Cups versions involved are 1.2.4 (Centos 5 running latest rpms) - Print Server 1.2.12 Fedora Client I have done some searching on the Web and see a fair number of problems with Duplex Printing but no real mention of solutions to this issue. So firstly have people been able to get duplex printing working correctly for lp or lpr ? If not what alternative solutions are people using ? If reliable duplex printing is possible can anyone direct me to some good documentation about this so I can see why my configuration is wrong. I have tried removing the client from the loop completely and still see the behavior when printing from the print server directly. I see that the cups rpms used are a number of versions behind the current stable shown at cups.org so I was considering building rpms using the latest stable source and the spec file that they provide. Is this viable or am I just asking for trouble ? Thank you for your time and any knowledge / experience you are willing to share. Have a nice day.

2 2

Cyrus-Imapd Sieve Unable to connect to server
by Alain Reguera Delgado 29 Jan '08

29 Jan '08

Hi, Do you know if sieve implementation on cyrus-imapd package is working correctly ? When trying to connect to timsieved at localhost with sieveshell I'm getting the following error: $ sieveshell --user=al --authname=cyrus localhost connecting to localhost unable to connect to server at /usr/bin/sieveshell line 169 The configuration on /etc/cyrus.conf is by defult. Port 2000 is listening on all tcp interfaces. This port is not open in Iptables configuration. >From localhost, when trying imtest, authentication works fine ... I'm using auxprop with sasldb2 here in a CentOS 5.0 box. Some idea ? Some related references I'v found: http://lists.linuxcoding.com/rhl/2005/msg03157.html http://www.irbs.net/internet/info-cyrus/0503/0205.html Thank you very much, al.

2 9

Re: [CentOS] Unknown rootkit causes compromised servers
by David Thompson 29 Jan '08

29 Jan '08

"Michael A. Peters" wrote: >> >> I have never understood this. If I have a good, strong password that nobody >> knows, how is changing it to another one an improvement over what I already >> have? > >I agree with you. For user accounts, changing one strong password for another gains you nothing, and may cause people to start writing things down, or choosing trivial passwords which still meet the password strength criteria, or whatever, actually weakening security. However, if you have admins who come into or leave employment, changing privileged account passwords (read: root or equiv) is a necessary activity. Cheers, Dave Thompson UW-Madison

3 2

yum update change kernel auto rebuild drivers centos 5.1
by Jerry Geis 29 Jan '08

29 Jan '08

Is there any "formal" mechanizism by which after a yum update , and kernel change that "drivers" can automatically be recompiled and a service restarted? Do I need to make my own? Thanks, Jerry

4 3

Rebuilding PHP: how do I manage updates?
by Niki Kovacs 29 Jan '08

29 Jan '08

Hi, Our public library management software (PMB) runs on Apache/PHP/MySQL. It requires some additional PHP modules to run correctly, namely: 1) php-gd 2) php-yaz 3) php-xslt I've googled and fiddled around quite a bit, and come to the following conclusions: 1) php-gd can be installed from extra repos (rpmforge IIRC), so this one's no problem. 2) To install php-yaz, I have to install the yaz library first. To do this, I download the FC6 SRPM for yaz from www.indexdata.dk, it builds without any problem, and I install the resulting libyaz3 and libyaz3-devel. Then, I can install the according PHP module with a simple 'pecl install yaz'. 3) Apparently, there's no php-xslt module around. AFAIK, the only way to have it is to build it into PHP. So I went and downloaded the PHP SRPM from one of the CentOS mirrors. I edited php.spec and added the following configure option in php.spec: --with-xslt-sablot After installing a myriad of build dependencies, I launched 'rpmbuild -bb --clean php.spec', and after a while, I got my /usr/src/redhat/RPMS/i386 directory chock-full with resulting PHP packages. I uninstalled everything I already had PHP-wise, like this: yum remove `rpm qa | grep php` Then I simply installed my resulting RPMS like this: rpm -ivh php-*.rpm I checked the PHP information page (with phpinfo()), and every module needed by my application was there. Now I wonder: how will I manage security and/or bugfix updates for PHP and its modules in the future? When simply issuing 'yum update', any update to php will squash my rebuilt version, and PMB will become dysfunctional. My first idea would be: see if there are available updates, and in that case, download the according SRPM, rebuild and reinstall the whole thing. But that sounds a bit tedious. Or simply put a line in /etc/yum.conf: exclude=php php-* ??? Any suggestions? Niki

2 5

centos 5.0/5.1 nfs kickstart
by Adam Miller 29 Jan '08

29 Jan '08

Hi all, I'm having a bit of trouble with something and was wondering if anyone else has encountered this or knows what the problem is. I have one computer I would like to kickstart a centos 5.0 or 5.1 install. I have another computer which is the tftpboot server and contains the centos 5.0 and centos 5.1 install directories I wish to do the kickstart over nfs and my network is using MTU of 4500. The machine will kickstart to the point of fetching the kickstart script from the server, but soon after stop responding. The machine is not locked but seems to be waiting on network traffic. Are there any known issues with kickstarting over nfs with jumbo frames? Thanks! Adam

4 10

rpm spec file
by Centos 29 Jan '08

29 Jan '08

Hello any one has spec file for cgicc and pyperl. or any good and quick document that shows how to create spec file. I don't want to compile it on our servers.

3 2

Intel dq35jo
by Milton Calnek 29 Jan '08

29 Jan '08

Hello all, I'm looking at buying an intel dq35jo mother board. From what I've read on the net other's have been using the board to one degree or another for a year now. My main concern is that I can install CentOS 5 over a network. Any comments? -- Milton Calnek BSc, A/Slt(Ret.) milton(a)calnek.com 306-717-8737 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Dump answer thanks
by Scott Ehrlich 29 Jan '08

29 Jan '08

Thanks to everyone who pointed out (and, had I read the man page, would have discovered) dump is for ext2/3, not cifs. And to those who gave insightful, brief summaries of how backuppc and amanda work. Much appreciated to all. Scott

1 0

Re: [CentOS] Unknown rootkit causes compromised servers
by Chris Mauritz 29 Jan '08

29 Jan '08

Alfredo Perez wrote: > I will add to that list, change ssh port 22 to somthing else > Why? Most of the script kiddies now check all the higher ports for ssh too. Moving ssh's port around solves nothing. Cheers,

2 1

Re: [CentOS] Unknown rootkit causes compromised servers
by Jim Perrin 29 Jan '08

29 Jan '08

On Jan 29, 2008 8:01 AM, Alfredo Perez <alfredoj69(a)rogers.com> wrote: > Thinking about the above made me ask the following question: > > Is it possible to setup Centos to ask for a change of password > every month? Yep. Change the values in /etc/login.defs for PASS_* and use: chage -M <value> -m <value> -W <value> USER -- During times of universal deceit, telling the truth becomes a revolutionary act. George Orwell

1 0

Re: [CentOS] Unknown rootkit causes compromised servers
by Les Bell 29 Jan '08

29 Jan '08

Frank Cox <theatre(a)sasktel.net> wrote: >> I have never understood this. If I have a good, strong password that nobody knows, how is changing it to another one an improvement over what I already have? << Correct. Modern thinking is to teach people how to create a good, strong password and then stick with it for a longer period than has traditionally been the case. A rainbow tables attack against a captured hash can be done in just a few seconds, so unless you're prepared to change your password every few seconds, it's a futile gesture. Because most sets of rainbow tables cover all combinations of upper/lower case alpha, numeric and punctuation symbols, a strong password should contain at least one control character, a composed character (using the Alt+numpad technique) or some other non-printable character outside the rainbow tables set. Or use two-factor authentication (RSA SecurID or similar tokens, certificates, etc.). Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

2 1

pygtk2 bug fix update
by Heiko Adams 29 Jan '08

29 Jan '08

Hello, when will this upstream update be available? http://rhn.redhat.com/errata/RHBA-2008-0079.html -- Heiko Adams <heiko.adams(a)gmail.com>

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss