- Discuss - lists.centos.org

Kickstart Questions
by Elrako X. Harkonnen 26 Dec '06

26 Dec '06

Hi, We dont run DHCP in our environment where I build our servers, is it required to get a first IP address to hit my kickstart server running on my xandros debian laptop? Just been a couple years since I last did some kickstart builds and I dont have system-config-kickstart running on a machine here in my home lab. I can turn on DHCP on my linux laptop perhaps, but just wanted to check in here before I over-engineer something. I have a line in the kickstart file that gives the machine it's network addressing like this (fictional IPs): network --device eth0 --bootproto *static* --*ip* 192.168.25.4 --netmask 255.255.255.0 --gateway 192.168.25.1 --nameserver 192.168.25.2,192.168.25.3 --hostname myhost4.mydomain.com it's right under these: (#question, it does go at the end, in the position I have it in right?) ----snip---------- # KICKSTART FOR STANDARD SERVER install cdrom lang en_US.UTF-8 langsupport --default=en_US.UTF-8 en_US.UTF-8 keyboard us # what's this for? I found it in an example file. # %include /tmp/netconfig firewall --disabled selinux --disabled # what's this for? Also found in example file. %include /tmp/authconfig # xconfig --startxonboot # #####Question: Do I just leave this 'xconfig' statement out completely since I dont run X? timezone --utc America/Los_Angeles bootloader --location=mbr --append="rhgb quiet" ###################################################################### ## DISK CONFIGURATION # Partitioning # Using the default partition table. clearpart --all --initlabel # can I add the '--drives=sda' sda section to the end of the above line? i got from example file wanted to combine with initlabel statement.. # clearpart --all --drives=sda part / --fstype "ext3" --size=1012 --ondisk=sda # do i need to call the sda scsi disk out if there are no IDE drives? part /boot --fstype "ext3" --size=256 --ondisk=sda part swap --size=8192 --ondisk=sda part /home --fstype "ext3" --size=8192 --ondisk=sda part /var --fstype "ext3" --size=8192 --ondisk=sda part /tmp --fstype "ext3" --size=1012 --ondisk=sda part /usr --fstype "ext3" --size=4096 --ondisk=sda part /var --fstype "ext3" --size=40960 --grow --ondisk=sda ###################################################################### ## PACKAGES %packages ## Standard packages @base @development-tools kernel network --device eth0 --bootproto *static* --*ip* 192.168.25.4 --netmask 255.255.255.0 --gateway 192.168.25.1 --nameserver 192.168.25.2,192.168.25.3 --hostname myhost.mydomain.com

3 2

Re: [CentOS] centos 5 beta 2 status
by Mike Seda 26 Dec '06

26 Dec '06

Hi All, Once centos 5 beta 2 is released, what will be the url for downloading it? Thx, Mike Johnny Hughes mailing-lists at hughesjr.com Thu Dec 21 14:46:23 UTC 2006 * Previous message: [CentOS] centos 5 beta 2 status * Next message: [CentOS] 64-bit Java? * Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] On Wed, 2006-12-20 at 01:26 +0900, Shawn wrote: > > HI, > > > But, you > > will get a "CentOS" quality product when we release it, beta or not. > > I don't want to read too much into what you say so I assume this means > that like RHEL5 betas, these betas are not upgradeable to a final > release version. > Every effort will be made to make CentOS-5 final be able to be an upgrade target of CentOS-5 beta. There may be some small individual issues (ie, a package is include as a test in the Beta, but upstream provider rolls back to an older package for release ... this has happened a couple times already in the past). For those kinds of issues, if you upgrade from Beta to Final, you will have to manually revert the older packages back ... We are obviously tied to the released Source Code, so there could be other issues, but it is one of our goals that the beta can be upgraded to the final. (My main workstation is an upgraded CentOS-4.0 beta 1 all the way up at each release to now CentOS-4.4 :P) Upgrades from CentOS-3 or 4 to CentOS-5 might be much harder ... and would most probably not be recommended, but possible. Thanks, Johnny Hughes

2 1

BlockHosts with CenOS 4.4?
by Iain Lee 24 Dec '06

24 Dec '06

I'm trying (and failing) to use BlockHosts to stop thousands of FTP login attempts. BlockHosts works fine with ssh but not with vsftp. I've found the problem but not the solution at http://www.aczoom.com/cms/forums/blockhosts/vsftp-hanging Can anyone could help with either getting BlockHosts to work or suggesting another method?

3 2

CentOS-announce Digest, Vol 22, Issue 4
by centos-announce-request＠centos.org 24 Dec '06

24 Dec '06

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2006:0760 Critical CentOS 4 ia64 thunderbird - security update (Pasi Pirhonen) 2. CESA-2006:0759 Critical CentOS 4 s390(x) seamonkey - security update (Pasi Pirhonen) 3. CESA-2006:0758 Critical CentOS 4 s390(x) firefox - security update (Pasi Pirhonen) 4. CESA-2006:0760 Critical CentOS 4 s390(x) thunderbird - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Sat, 23 Dec 2006 20:02:01 +0200 From: Pasi Pirhonen <upi(a)centos.fi> Subject: [CentOS-announce] CESA-2006:0760 Critical CentOS 4 ia64 thunderbird - security update To: centos-announce(a)centos.org Message-ID: <20061223180201.GQ12634(a)centos.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2006:0760 https://rhn.redhat.com/errata/RHSA-2006-0760.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/thunderbird-1.5.0.9-0.1.el4.centos4.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://pasi.pirhonen.eu/ Top-postings silently ignored

1 0

Copying my system to another drive
by Christophe 24 Dec '06

24 Dec '06

Hi, I'm trying to copy my CentOS install to a new drive. - old drive is /dev/hda and had hda1 : /boot hda2 : swap hda3 lvm hda5 : lvm hda4 : /usr/local - new drive is /dev/hdb hdb1 : /boot hdb2 : swap hdb3 : / I decided to get rid of lvm which is useless to me. I've created and formated the new partitions and copied anything from the old drive to the new one excepted the /dev entries by issuing some cp -a With grub I did root (hd1,0) then setup (hd1) I've also modified the content of hdb1 /boot/grub/grub.conf and passed param root=/dev/hdb3 to the kernel I didn't find how to created all the /dev entries but I read somewhere that 2.6 kernels create them at boot time. So, what is the problem ? (I boot my server by selecting the new drive from the BIOS boot devices menu) : boot goes until 'checking root filesystem', then complains about something really wrong on /dev/hdb3 and send me to a kind of rescue shell. I did a fsck on /dev/hdb3 which says the volume is clean Don't know what I've missed and what I have to fix... just in case, cat /proc/mounts gives me rootfs / rootfs rw 0,0 /proc /proc proc rw,nodiratime 0 0 none /dev tmpfs rw 0 0 /proc /proc proc rw,nodirattime 0 0 /proc/bus/usb /proc/bus/usb usbfs rw 0 0 /sys /sys sysfs rw 0 0 none /dev/pts devpts rw 0 0 Thanks and merry Christmas to all ! ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 2

CentOS-announce Digest, Vol 22, Issue 3
by centos-announce-request＠centos.org 23 Dec '06

23 Dec '06

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2006:0749 Moderate CentOS 4 ia64 tar - security update (Pasi Pirhonen) 2. CESA-2006:0749 Moderate CentOS 4 s390(x) tar - security update (Pasi Pirhonen) 3. CESA-2006:0749 Moderate CentOS 3 ia64 tar - security update (Pasi Pirhonen) 4. CESA-2006:0749 Moderate CentOS 3 s390(x) tar - security update (Pasi Pirhonen) 5. CESA-2006:0759 Critical CentOS 3 ia64 seamonkey - security update (Pasi Pirhonen) 6. CESA-2006:0759 Critical CentOS 3 s390(x) seamonkey - security update (Pasi Pirhonen) 7. CESA-2006:0749 Moderate CentOS 4 i386 tar - security update (Johnny Hughes) 8. CESA-2006:0749 Moderate CentOS 4 x86_64 tar - security update (Johnny Hughes) 9. CESA-2006:0759-01 Critical CentOS 3 s390(x) seamonkey - security update (Pasi Pirhonen) 10. CESA-2006:0759 Critical CentOS 4 x86_64 seamonkey - security update (Johnny Hughes) 11. CESA-2006:0759 Critical CentOS 4 i386 seamonkey - security update (Johnny Hughes) 12. CESA-2006:0758 Critical CentOS 4 x86_64 Firefox - security update (Johnny Hughes) 13. CESA-2006:0760 Critical CentOS 4 x86_64 Thunderbird - security update (Johnny Hughes) 14. CESA-2006:0758 Critical CentOS 4 i386 Firefox - security update (Johnny Hughes) 15. CESA-2006:0760 Critical CentOS 4 i386 Thunderbird - security update (Johnny Hughes) 16. CESA-2006:0759 Critical CentOS 4 ia64 seamonkey - security update (Pasi Pirhonen) 17. CESA-2006:0758 Critical CentOS 4 ia64 firefox - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Fri, 22 Dec 2006 23:47:12 +0200 From: Pasi Pirhonen <upi(a)centos.fi> Subject: [CentOS-announce] CESA-2006:0749 Moderate CentOS 4 ia64 tar - security update To: centos-announce(a)centos.org Message-ID: <20061222214711.GF12634(a)centos.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2006:0749 https://rhn.redhat.com/errata/RHSA-2006-0749.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/tar-1.14-12.RHEL4.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://pasi.pirhonen.eu/ Top-postings silently ignored

1 0

recommneded tape drives
by Dustin Krysak 23 Dec '06

23 Dec '06

Hi there, I am pricing out a dell 840 (low end file server) that will run latest centos. Can anyone recommend a good tape drive/card combo with centos? The drives (to be backed up) in it will be a raid 0 - 500gb. Thanks in advance! Dustin

4 3

How to connect to a Windows PC in LAN
by Ha Thai Duong 22 Dec '06

22 Dec '06

Hi I am a new bee to Linux in general. Please accept my apologies if the question is not appropriate. I have a LAN with 2 computers: One is CentOS and one is Windows XP. I am trying to transfer file between 2 computers using LAN. Can you please tell me how to do it? I have tried Samba from the Applications menu. Add a directory in there. Set it to Read only and Allow access to everyone. I couldn't see the CentOS from Windows computer. I have tried the Network Servers. There is Windows Network there. When i click to see inside that, there is nothing. I tried to see the all the services are running. The winbind status is winbindd dead but subsys locked. Thanks a lot for your help. I do appreciate that.

8 8

Slightly OT: DNS -force client always use authoritative
by Karl R. Balsmeier 22 Dec '06

22 Dec '06

Is there a specific way to set a name server so that clients are always *forced* to use an autoritative name server? UltraDNS and some others have mentioned little features they have, but it only hints at the possibility that somewhere in the DNS spec. -karlski

6 10

Upgrading Server Motherboard
by Matt 22 Dec '06

22 Dec '06

I have a server running CentOS 4.2 that works as a web/email with very heavy load. It runs Directadmin web gui which is like Cpanel. It runs on a cheapy mATX motherboard(ECS 741GX-M) with socket A 2800+ CPU and 2Gbyte DDR. The OS and data are on a 300Gbyte PATA maxtor drive and data backups are run weekly to another PATA drive. The server is overwelmed and data backups take over 5 hours to complete. I have a Tyan(K8E) server board now that is socket 939 with SATA support. Maxtor makes a utillity that will copy there drives so I bought a second identical PATA drive and plan on copying it so if I screw something up it will be a backup copy and not the critical original. >My first question is can I simply plug this drive into the new faster motherboard and have it just boot up and run? >Next, should I get a dual core CPU or just a fast single core? Most of the load on this server is due to Spamassassin dealing with about 2000 email accounts. Although it also serves up websites that is pretty minor load I beleive since they do not get all that many hits. >I was told up2date will update this server too 4.4. Problem is that the Directadmin GUI is a bit touchy. Any modifications to the services its married to could be bad. I really need to talk to there tech support on this. >My new server motherboard is socket 939 and supports DDR 400. It was a bargin off ebay but appears to work fine. Would I be better off getting a socket AM2 that supports DDR2 or will that make much difference in performance? The 939 motherboard supports a max of 4Gbyte DDR too. >I also purchased a Seagate SATA 500Gbyte drive. The 300G PATA drive is just under half full. I imagine mostly email. Mailboxes for the most part have 50M cap but there alot of them and still adding more. Is there anyway to copy the OS installed on the PATA to a larger and faster SATA drive? I am doubting this since the drives place/mnt in /dev will change. I know the best solution is to install CentOS 4.4 on new box, install Directadmin, and then backup and restore to new server but that will result in substantial downtime that I am trying to get out off. Plus a lot of work. The Directadmin install has been heavilly customized and I will need to remember what I all did to it. Actually I may still do that but I would like to move to a faster motherboard first so just maybe the backups run faster. Thanks for any help or advice. Matthew

4 4

Centos 4.0 (Final) and Dell 1950 with SAS controller
by Glenn MacGregor 22 Dec '06

22 Dec '06

Hi All, I have an "appliance" cd which uses CentOS 4.0 (Final) which I am trying to load on a new Dell 1950 server with a SAS driver controller. During the install it fails to find any disks to load to. I got the drivers from Dell and dd the correct one to a floppy, boot from the appliance cd and enter linux dd at the prompt. I load the driver in the install and it still fails to find any disks. I have looked at the virtual consoles after the module disk and I see some strange information: failed to open /tmp/drivers/modules.pcimap: no such file or directory failed to open /tmp/drviers/pci.ids: no such file or directory ..... modules to insert mptbase mptscsih mptsas module(s) mptbase mptscsih mptsas not found So the driver disk is loading but....it can't find the modules. So I went on looking at the driver disk and found: -rw-r--r-- 1 root root 48 Dec 20 2005 disk-info drwx------ 2 root root 12288 Dec 20 2005 lost+found -rw-r--r-- 1 root root 330 Dec 20 2005 modinfo -rw-r--r-- 1 root root 817645 Dec 20 2005 modules.cgz -rw-r--r-- 1 root root 116 Dec 20 2005 modules.dep -rw-r--r-- 1 root root 52852 Dec 20 2005 packages.py -rw-r--r-- 1 root root 993 Dec 20 2005 pcitable -rw-r--r-- 1 root root 32 Dec 20 2005 rhdd So I figured out that modules.cgz is zip and cpio'd, I undid it and this is what is in that archive: drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-11.EL drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-11.ELhugemem drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-11.ELsmp drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-22.EL drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-22.ELhugemem drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-22.ELsmp drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-5.EL drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-5.ELhugemem drwxr-xr-x 3 root root 4096 Dec 21 14:22 2.6.9-5.ELsmp -rwxr-xr-x 1 root root 3850 Dec 20 2005 fusion.mptctl This seemed strange to me because CentOS 4.0 uses kernel 2.6.9-5.0.3.EL. So my question is could that be why the modules can not be found? If so what changes do I need to make to this driver disk to get working on CentOS 4.0? The controller is LSISAS1068 Sorry for the long post and thanks for the help. Glenn -- Glenn MacGregor HighStreet Networks

3 2

Printer job control
by Ted Miller 22 Dec '06

22 Dec '06

What do I have to change to allow ANY user to control ANY print job? Having this locked on a workstation with a local printer attached just makes me want to take Centos and throw it across the room, especially when I can't even stop my own print jobs when something goes wrong. This has already cost me considerable money in wasted ink. This should be a check-box somewhere, or else a simple .rpm to download and run that would take care of this. Ted Miller Indiana

2 2

Understanding cpuspeed/cpufreq
by James Pearson 22 Dec '06

22 Dec '06

[I sent this to the RHEL4 list - but maybe someone on this list knows more] I have a number of dual CPU and dual CPU/dual core Opteron systems that are used as compute servers. In an effort to reduce power consumption and reduce heat output, I would like to make use of the PowerNow! capabilities to clock back the CPUs when the machines are idle. These machines are running a 2.6.9-42 RHEL4 kernel However, in my tests so far in using the cpuspeed daemon or setting the kernel cpufeq governor to 'ondemand', the CPU will clock back their frequencies in situations where one or more CPUs are being heavily used i.e not what I want. Having a look through the cpuspeed daemon src (there is no man page), it forks a separate process to monitor each CPU - however, AFAIK it is not possible to runs these CPUs at different speeds - so it appears that when one of the daemons decides it should clock back 'its' CPU, all the CPUs are clocked back ... regardless of the fact that one or more of the other CPUs may be busy. Something similar seems to be happening using the various cpufreq governors - configuration is available for all CPUs separately (under /sys/devices/system/cpu/cpuN/cpufreq). i.e. it appears you can configure settings for each CPU independently, but in reality all CPUs must run at the same speed. Essentially what I want to achieve is something like: if _any_ CPU is 'busy' (usage over some threshold over some sampling period), then run at full speed and if _all_ CPUs are 'idle' (all below some threshold over some sampling period) then clock back the CPUs. Is there something/some setting(s) that can do this? Thanks James Pearson

1 0

chkrootkit reporting possible LKM trojan
by Leonardo Vilela Pinheiro 22 Dec '06

22 Dec '06

How can I be sure if it is LKM or not? Today I've run chkrootkit and it gave me: Checking `lkm'... You have 179 process hidden for readdir command You have 179 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed Checking `chkutmp'... The tty of the following user process(es) were not found in /var/run/utmp ! ! RUID PID TTY CMD ! root 3206 tty1 /sbin/mingetty tty1 ! root 3285 tty2 /sbin/mingetty tty2 ! root 3337 tty3 /sbin/mingetty tty3 ! root 3388 tty4 /sbin/mingetty tty4 ! root 3439 tty5 /sbin/mingetty tty5 Those hidden tty can be "su -" sessions that I have just started. The computer has just been restarted, and I have just opened those su sessions. There are also some "hidden files", all of them named .packlist and .exists. Everything else is fine. rkhunter looks fine. " rpm -Va kernel* " looks fine. Remote users access are being controlled through /etc/ssh/sshd_config in a user-host fashion. Thanks in advance. -- Vilela

2 3

centos 5 beta 2 status
by Jerry Geis 21 Dec '06

21 Dec '06

Hi all Was curious how the beta is coming along. Was expecting to see it on monday, looking forward to playing over the holidays. Thanks, Jerry

8 11

Selective Sendmail Relaying.
by Will McDonald 21 Dec '06

21 Dec '06

Hi all, I've been trying to hit on the right configuration combo to allow relaying from specific users and/or domains to an internal box running Sendmail. Reading the docs at http://www.sendmail.org/m4/anti_spam.html#relay and http://www.sendmail.org/m4/anti_spam.html#access_db_fine I would appear that I should be able to all per-address relaying in /etc/mail/access by enabling FEATURE(`relay_mail_from')dnl in sendmail.mc and restarting Sendmail. Then adding test(a)testdomain.com to /etc/access as: From:test@testdomain.com RELAY Should allow relaying FROM this address, yet it doesn't seem to work for me on a CentOS 4.4 system and I can't quite hit on why. My full sendmail.mc is... divert(-1)dnl dnl # dnl # This is the sendmail macro config file for m4. If you make changes to dnl # /etc/mail/sendmail.mc, you will need to regenerate the dnl # /etc/mail/sendmail.cf file by confirming that the sendmail-cf package is dnl # installed and then performing a dnl # dnl # make -C /etc/mail dnl # dnl # $Id: sendmail.mc,v 1.3 2006/05/09 10:48:40 root Exp $ dnl # include(`/usr/share/sendmail-cf/m4/cf.m4')dnl VERSIONID(`setup for Red Hat Linux')dnl OSTYPE(`linux')dnl define(`SMART_HOST',`mailscanner.testdomain.com') define(`confDEF_USER_ID',``8:12'')dnl define(`confTO_CONNECT', `1m')dnl define(`confTRY_NULL_MX_LIST',true)dnl define(`confDONT_PROBE_INTERFACES',true)dnl define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl define(`ALIAS_FILE', `/etc/aliases')dnl define(`STATUS_FILE', `/var/log/mail/statistics')dnl define(`UUCP_MAILER_MAX', `2000000')dnl define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl define(`confAUTH_OPTIONS', `A')dnl define(`confTO_IDENT', `0')dnl FEATURE(`no_default_msa',`dnl')dnl FEATURE(`smrsh',`/usr/sbin/smrsh')dnl FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl FEATURE(redirect)dnl FEATURE(always_add_domain)dnl FEATURE(use_cw_file)dnl FEATURE(use_ct_file)dnl FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl FEATURE(`access_db',`hash -T<TMPF> -o /etc/mail/access.db')dnl FEATURE(`relay_mail_from')dnl FEATURE(`blacklist_recipients')dnl EXPOSED_USER(`root')dnl DAEMON_OPTIONS(`Port=smtp,Addr=192.168.24.112,Name=MTA')dnl FEATURE(`accept_unresolvable_domains')dnl LOCAL_DOMAIN(`willspc')dnl MAILER(smtp)dnl MAILER(procmail)dnl In my maillog I just see... Dec 20 12:10:48 willspc sendmail[24558]: kBKCAlG2024558: ruleset=check_rcpt, arg1=<wmcdonald(a)gmail.com>, relay=nectarine [192.168.24.111], reject=550 5.7.1 <wmcdonald(a)gmail.com>... Relaying denied Dec 20 12:10:48 willspc sendmail[24558]: kBKCAlG2024558: from=<test(a)testdomain.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=nectarine [192.168.24.111] Am I missing something obvious/stupid? I would have thought Sendmail would've accepted and relayed it to its smart host. Switching to "FEATURE(`relay_entire_domain')" works but seems a bit extreme. Will.

3 5

Where to get version 3.5?
by Scott Ehrlich 21 Dec '06

21 Dec '06

Yes, I know it is old, but I'm looking for a copy of CentOS 3.5 - CDs or DVD for i386. I can only find 3.8. Thanks for any leads. Scott

12 16

ClamAV Installation
by Jun Salen 21 Dec '06

21 Dec '06

Hi All, I try to installed ClamAV using rpm from Karan.org repository but I can't find the clamd.conf and freshclam.conf file. After listing the file installed by using rpm -ql | grep clamav, I observe that it was really not included in the installation. Did I miss something here? If possible, I want to use RPM based installation for easy maintenance and also based on your suggestions from my prior posting, I don't know much configuring ClamAV and will use the confif file as basis for my setup. Merry Christmas and Happy new year to all! Thanks. junji linux registered user #253162 Send instant messages to your online friends http://uk.messenger.yahoo.com

4 3

64-bit Java?
by David Mackintosh 21 Dec '06

21 Dec '06

Hi folks, Stupid question time, possibly only tangentially related to CentOS, and I apoligise in advance. I have a bunch of CentOS 64-bit boxes, and I have developers who want to run eclipse on these boxes. So I have downloaded the 64-bit bundle of eclipse, installed the java from java.sun.com, and the result is that Eclipse won't run. It chugges away and then reports: $ /tools/ecad/local/eclipse_64/eclipse -vm /usr/java/jre1.5.0_10/bin/java !ENTRY org.eclipse.osgi 4 0 2006-12-19 11:20:01.634 !MESSAGE Application error !STACK 1 java.lang.UnsatisfiedLinkError: /home/uxilium/.eclipse/org.eclipse.platform_3.2.0/configuration/org.eclipse.osgi/bundles/568/ 1/.cp/libswt-pi-gtk-3235.so: Can't load AMD 64-bit .so on a IA 32-bit platform So clearly I have a 32-bit Java on my 64-bit platform. However I cannot see any 64-bit java to install. Does anyone out there have any ideas where to look for a 64-bit linux java? -- /\oo/\ / /()\ \ David Mackintosh | dave(a)xdroop.com | http://www.xdroop.com

5 4

Re: [CentOS] ClamAV Installation
by Brent Rynn 21 Dec '06

21 Dec '06

try DAG Weieers as a source for rpms the website is http://dag.wieers.com/packages/clamav/ Also make sure you have the right user permisions and logs and such config files should be under your $/etc/ folder > Hi All, > > I try to installed ClamAV using rpm from Karan.org > repository but I can't find the clamd.conf and > freshclam.conf file. After listing the file installed > by using rpm -ql | grep clamav, I observe that it was > really not included in the installation. Did I miss > something here? If possible, I want to use RPM based > installation for easy maintenance and also based on > your suggestions from my prior posting, I don't know > much configuring ClamAV and will use the confif file > as basis for my setup. Merry Christmas and Happy new > year to all! Thanks. > > junji > linux registered user #253162 > > Send instant messages to your online friends http://uk.messenger.yahoo.com > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos >

1 0

iptables command to view just nat/forward info by ip
by Dustin Krysak 21 Dec '06

21 Dec '06

Hi there... does anyone know of a handy iptables command to look at existing nat rules? I tried: iptables -t nat -L Which was close, but the problem is that the DNAT and SNAT list the reverse DNS for the IP's, when I would rather see just pure IP's. I have been reading the man pages and google looking for an answer as well. Thanks!

5 5

CentOS-announce Digest, Vol 22, Issue 2
by centos-announce-request＠centos.org 20 Dec '06

20 Dec '06

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2006:0749-01: Moderate CentOS 2 i386 tar security update (John Newbigin) 2. CESA-2006:0759-01: Critical CentOS 2 i386 seamonkey security update (John Newbigin) 3. CESA-2006:0749 Moderate CentOS 3 i386 tar - security update (Tru Huynh) 4. CESA-2006:0749 Moderate CentOS 3 x86_64 tar - security update (Tru Huynh) 5. CESA-2006:0759 Critical CentOS 3 i386 seamonkey - security update (Tru Huynh) 6. CESA-2006:0759 Critical CentOS 3 x86_64 seamonkey - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Wed, 20 Dec 2006 14:41:54 +1100 From: John Newbigin <jnewbigin(a)ict.swin.edu.au> Subject: [CentOS-announce] CESA-2006:0749-01: Moderate CentOS 2 i386 tar security update To: centos-announce(a)centos.org Message-ID: <4588B102.6050400(a)ict.swin.edu.au> Content-Type: text/plain; charset=us-ascii; format=flowed The following errata for CentOS-2 have been built and uploaded to the centos mirror: RHSA-2006:0749-01 Moderate: tar security update Files available: tar-1.13.25-6.AS21.1.i386.rpm More details are available from the RedHat web site at https://rhn.redhat.com/errata/rh21as-errata.html The easy way to make sure you are up to date with all the latest patches is to run: # yum update -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin ------------------------------ Message: 2 Date: Wed, 20 Dec 2006 16:41:20 +1100 From: John Newbigin <jnewbigin(a)ict.swin.edu.au> Subject: [CentOS-announce] CESA-2006:0759-01: Critical CentOS 2 i386 seamonkey security update To: centos-announce(a)centos.org Message-ID: <4588CD00.8040808(a)ict.swin.edu.au> Content-Type: text/plain; charset=us-ascii; format=flowed The following errata for CentOS-2 have been built and uploaded to the centos mirror: RHSA-2006:0759-01 Critical: seamonkey security update Files available: seamonkey-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-nspr-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-nspr-devel-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-nss-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-nss-devel-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-devel-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-mail-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-chat-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-js-debugger-1.0.7-0.1.el2.c2.1.i386.rpm seamonkey-dom-inspector-1.0.7-0.1.el2.c2.1.i386.rpm More details are available from the RedHat web site at https://rhn.redhat.com/errata/rh21as-errata.html The easy way to make sure you are up to date with all the latest patches is to run: # yum update -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin ------------------------------ Message: 3 Date: Wed, 20 Dec 2006 16:42:51 +0100 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2006:0749 Moderate CentOS 3 i386 tar - security update To: centos-announce(a)centos.org Message-ID: <20061220154251.GA876(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2006:0749 tar security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2006-0749.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/tar-1.13.25-15.RHEL3.i386.rpm source: updates/SRPMS/tar-1.13.25-15.RHEL3.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update tar Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Compatible hardware
by Jordi Espasa Clofent 20 Dec '06

20 Dec '06

Hi, I supose the https://hardware.redhat.com/hwcert/index.cgi link means a trusted source if I want to buy any hardware which will runs CentOS system. ¿Am I right? -- Jordi Espasa Clofent PGP id 0xC5ABA76A #http://pgp.mit.edu/ FSF Associate Member id 4281 #http://www.fsf.org/

2 1

Multimedia setup for LTSP
by Jordi Espasa Clofent 20 Dec '06

20 Dec '06

Hi all, I'm setting up a CentOS 4 in AMD64 box. The goal is to mount a terminal server with LTSP software. Currenlty I'm in troubles with the multimedia support. I've added Dag's, Karanbir's and Dries' repositories according that. ¿Is there some intention to make a multimedia group as others groups (FTP Server, Web Server... etc)? It would be great. ¿What packages do you recommend to me for that (I supose lame, mplayer...)? ¿Is there any way to install w32codecs package in my AMD64 box? TIA. -- Jordi Espasa Clofent PGP id 0xC5ABA76A #http://pgp.mit.edu/ FSF Associate Member id 4281 #http://www.fsf.org/

2 2

Software for monitoring user activities
by ankush grover 19 Dec '06

19 Dec '06

hey friends, We are running 2 Centos servers 4.0 and 4.4 in our office for various activies like Mailing, Web Services, Database, CVS, FTP,Samba, Squid etc. We have about 100+ users on those servers , many users don't have shell on these servers (/sbin/nologin set as default shell) and some has shell (/bin/bash). We want to monitor the user activities of those users who have shell means what they all do on the server. One of the servers contains important data in the database and we don't want authorized users as they have access to this data and can copy this data to somewhere else like to their local systems. We want to track/monitor the activities of the users. Is there any free open source software available which can show daily /weekly/ monthly repots of the users activities. Please let me know if you need any further inputs. Regards Ankush Grover

2 1

Diagnosing random hangs
by Mark Belanger 19 Dec '06

19 Dec '06

I have many different centos machines that are hanging regulary. I believe this is due to something our application is doing - not a centos specific problem. When the machines hang, there is no access to the console or remote access(ssh, rsh, etc). Any tips on debugging this issue? It is becoming quite a show stopper as we migrate our product from Solaris to Linux. tia, FYI - The "application" is a collection of programs that communicate with each other and to a large chip tester via a proprietary serial bus. The hangs are random but pretty frequent - in the range of several per day to several per week. -Mark -- Mark Belanger LTX Corporation

10 17

Mail Server instalation package?
by Jordi Espasa Clofent 19 Dec '06

19 Dec '06

Hi all, I don't see any package called "Mail Server" when I execute su -c "yum grouplist". ¿Why? I can see others as "Web Server". "Windows File Server". Mailserver is a very common server ¿Does not exist a package instalation for it? Thanks. -- Jordi Espasa Clofent PGP id 0xC5ABA76A #http://pgp.mit.edu/ FSF Associate Member id 4281 #http://www.fsf.org/

3 3

Isag Similar command in CentOS 4.4
by balajisundar＠midascomm.com 19 Dec '06

19 Dec '06

Dear all, Is there any utility similar to isag in Redhat 7.2 on CentOS 4.4. --Regards S.Balaji

1 0

Re: CentOS Digest, Vol 23, Issue 18
by Shahriar Akther 19 Dec '06

19 Dec '06

hi I am new at CentOS.I am not able to install webmin at Centos.if there is no problem at webmin installing at Cent .where I will get the webmin rpm for Cent. Thanks shahriar Quoting centos-request(a)centos.org: > Send CentOS mailing list submissions to > centos(a)centos.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.centos.org/mailman/listinfo/centos > or, via email, send a message with subject or body 'help' to > centos-request(a)centos.org > > You can reach the person managing the list at > centos-owner(a)centos.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of CentOS digest..." > > > Today's Topics: > > 1. How to connect to a Windows PC in LAN (Ha Thai Duong) > 2. Re: How to connect to a Windows PC in LAN (MrKiwi) > 3. creating script for init.d (Linux Man) > 4. Re: Intel 965 Chipset on 4.4 ? (Angel Marin) > 5. Re: How to connect to a Windows PC in LAN (MikeW) > 6. command line with < > and not wanting to redirect (Jerry Geis) > 7. Upgrading Server Motherboard (Matt) > 8. Re: command line with < > and not wanting to redirect > (Diaa Radwan) > 9. Re: Upgrading Server Motherboard (Kevan Benson) > 10. Re: command line with < > and not wanting to redirect > (Aleksandar Milivojevic) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 17 Dec 2006 22:10:19 +0000 > From: Ha Thai Duong <duongthaiha(a)gmail.com> > Subject: [CentOS] How to connect to a Windows PC in LAN > To: centos(a)centos.org > Message-ID: <4585C04B.4070406(a)gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi > I am a new bee to Linux in general. Please accept my apologies if the > question is not appropriate. > > I have a LAN with 2 computers: One is CentOS and one is Windows XP. > I am trying to transfer file between 2 computers using LAN. Can you > please tell me how to do it? > > I have tried Samba from the Applications menu. > Add a directory in there. Set it to Read only and Allow access to > everyone. I couldn't see the CentOS from Windows computer. > > I have tried the Network Servers. There is Windows Network there. When i > click to see inside that, there is nothing. > > I tried to see the all the services are running. The winbind status is > winbindd dead but subsys locked. > > Thanks a lot for your help. I do appreciate that. > > > ------------------------------ > > Message: 2 > Date: Mon, 18 Dec 2006 11:45:11 +1300 > From: MrKiwi <mrkiwi(a)gmail.com> > Subject: Re: [CentOS] How to connect to a Windows PC in LAN > To: CentOS mailing list <centos(a)centos.org> > Message-ID: <4585C877.3060106(a)gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > Ha Thai Duong wrote: >> Hi >> I am a new bee to Linux in general. Please accept my apologies if the >> question is not appropriate. >> >> I have a LAN with 2 computers: One is CentOS and one is Windows XP. >> I am trying to transfer file between 2 computers using LAN. Can you >> please tell me how to do it? >> >> I have tried Samba from the Applications menu. >> Add a directory in there. Set it to Read only and Allow access to >> everyone. I couldn't see the CentOS from Windows computer. >> >> I have tried the Network Servers. There is Windows Network there. When i >> click to see inside that, there is nothing. >> >> I tried to see the all the services are running. The winbind status is >> winbindd dead but subsys locked. >> >> Thanks a lot for your help. I do appreciate that. >> _______________________________________________ >> CentOS mailing list >> CentOS(a)centos.org >> http://lists.centos.org/mailman/listinfo/centos >> > "service smb status" will tell you if the services (smbd, > nmbd) are running but ... > > Maybe your firewall is active and blocking your requests; > > From a root prompt type > # service iptables status > > If the response is "Firewall is stopped" then this is not > the problem - however if you get a list of the firewall > entries, then try > # service iptables status|egrep "445|137|138|139" > You should see 4 or so entries listed for the various > services related to samba sharing. > > If you see none, you need to either ; > A. > stop the firewall (not recommended, but you may want to stop > it to confirm that the firewall is the issue) using > # service iptables stop > (restart it with # service iptables start) > B. > config the firewall to allow these ports (recommended solution) > > try /usr/sbin/s > > set Security Level to "Enabled", > Customize, under "Other ports" type "445:tcp 137:udp 138:udp > 139:tcp" > > This should allow all the samba services to ba accessed. > > Regards, > > MrKiwi > > > > ------------------------------ > > Message: 3 > Date: Sun, 17 Dec 2006 23:29:46 -0200 > From: "Linux Man" <linuxman.uru(a)gmail.com> > Subject: [CentOS] creating script for init.d > To: centos(a)centos.org > Message-ID: > <cd66ad610612171729x16eb868egdfb3c50ce39d29bb(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hello. > I'm moving from a very old Fedora Core 1 to CentOS 4.4, what a change!! > Three year ago, I wrote some script (network related) and worked very well. > Now, I can put into init.d by means of chkconfig and I restarted the system, > but always hang when executing my srcipt (in my new centos 4.4). > There a manual for making scripts for init.d? > there is some new requirement by which it does not work anymore? > Thanks a lots!!!! >

2 1

command line with < > and not wanting to redirect
by Jerry Geis 19 Dec '06

19 Dec '06

How do you format a command line that needs < > and they are not meant to redirect anything they are part of an email address. command -f "Some Email <someemail(a)somedomain.com>" -x -y -z I tried putting a backslach in front of the < and > but that didnt do it either. Thanks, Jerry

8 10

Re: [CentOS] creating script for init.d
by Michael Velez 19 Dec '06

19 Dec '06

For some reason, this e-mail was only sent to me. Make sure you send to Centos mailing list. Try to run the script on the command line (not during the standard init process). Put #!/bin/bash as it does look like it's bash (but hey I could be wrong). Try to figure out where the script is hanging by using the -v or -x options, one at a time. #!/bin/bash -v #!/bin/bash -x You definitely need to provide more info. Michael > -----Original Message----- > From: Linux Man [mailto:linuxman.uru@gmail.com] > Sent: Tuesday, December 19, 2006 12:30 AM > To: mikev777(a)hotmail.com > Subject: here is the scrpit > > 2006/12/18, Michael Velez <mikev777(a)hotmail.com>: > > > > -----Original Message----- > > From: centos-bounces(a)centos.org <mailto:centos-bounces@centos.org> > > [mailto:centos-bounces@centos.org] On Behalf Of Linux Man > > Sent: Sunday, December 17, 2006 8:30 PM > > To: centos(a)centos.org <mailto:centos@centos.org> > > Subject: [CentOS] creating script for init.d > > > > Hello. > > I'm moving from a very old Fedora Core 1 to CentOS 4.4, what a > > change!! > > Three year ago, I wrote some script (network related) and > worked very > > well. Now, I can put into init.d by means of chkconfig and > I restarted > > the system, but always hang when executing my srcipt (in my > new centos > > 4.4 ). > > There a manual for making scripts for init.d? > > there is some new requirement by which it does not work anymore? > > Thanks a lots!!!! > > > > > > Are you using the 'su' command in your script? > > This happenned to me when I moved to RHEL4/Centos 4. My > problem was due to SELinux. I was using the 'su' command. > When I changed it to use the 'runuser' command instead, it > worked fine. The reason it was hanging for me is that using > the su command produces a context question on the console > (during password checking) for which I had to press enter. > With 'runuser', you don't get the SELinux context question. > > Michael > > ______________________________ > > _________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > > > > > > > This is the scrpit that I use, there's somethig wrong? > > > #Script configurado y optimizado para el servidor SunSet # > #chkconfig: 35 98 27 > # > #Description: Firewall > > > # Hubicacion de los binarios de IPTABLES y sus comandos > IPTABLES="/sbin/iptables" > > > case "$1" in > stop) > echo "Shutting down firewall..." > $IPTABLES -F > $IPTABLES -F -t mangle > $IPTABLES -F -t nat > $IPTABLES -X > $IPTABLES -X -t mangle > $IPTABLES -X -t nat > > $IPTABLES -P INPUT ACCEPT > $IPTABLES -P OUTPUT ACCEPT > $IPTABLES -P FORWARD ACCEPT > echo "...done" > ;; > status) > echo $"Table: filter" > iptables --list > echo $"Table: nat" > iptables -t nat --list > echo $"Table: mangle" > iptables -t mangle --list > ;; > restart|reload) > $0 stop > $0 start > ;; > start) > echo "Starting Firewall..." > echo "" > > > ##--------------------------Inicio del > Firewall---------------------------------## > > > #----Interfaces por Defecto-----# > > ## Interface Externa (a Internet) > DEFAULT_EXTIF="eth0" > > ## Interface Interna (a Lan) > DEFAULT_INTIF="eth1" > > ## Interface Interna (a CAMARA) > DEFAULT_CAMIF="eth2" > > #----Variables Especiales-----# > > # IP y Mascara para todas las IP (all) > UNIVERSE="0.0.0.0/0" > > # Specification of the high unprivileged IP ports. > UNPRIVPORTS="1024:65535" > > # Specification of X Window System (TCP) ports. > XWINPORTS="6000:6063" > > # Ports for IRC-Connection-Tracking > IRCPORTS="6665,6666,6667,6668,6669,7000" > > # Maquinas del Cyber > A1="192.168.0.3" > A2=" 192.168.0.4 <http://192.168.0.4> " > A3="192.168.0.5" > A4="192.168.0.6" > A5="192.168.0.7" > A6=" 192.168.0.8" > A7="192.168.0.9" > A8="192.168.0.10" > B1=" 192.168.0.11 <http://192.168.0.11> " > B2="192.168.0.12" > B3="192.168.0.13" > B4="192.168.0.14" > B5="192.168.0.15" > B6="192.168.0.16" > J1="192.168.0.100" > J2=" 192.168.0.101 <http://192.168.0.101> " > J3="192.168.0.103" > J4="192.168.0.105" > J5="192.168.0.104" > J6="192.168.0.102" > JEJE="192.168.0.2" > > # Casa > # Almaceno en la variable "actual" el valor de la IP actual > ACTUAL=$(host -R 2 -W 3 latinloveruy.homelinux.net > 63.208.196.90 | grep address | awk '{ print $4}') > > # Pruebo por si no hubo respuesta del servidor y en ese caso > uso ns2 if [ "$actual" = "" ]; then ACTUAL=$(host -R 2 -W 3 > latinloveruy.homelinux.net 204.13.249.81 | grep address | awk > '{ print $4}') fi > > # Pruebo por si no hubo respuesta del servidor y en ese caso > uso ns3 if [ "$actual" = "" ]; then ACTUAL=$(host -R 2 -W 3 > latinloveruy.homelinux.net 204.13.250.81 | grep address | awk > '{ print $4}') fi > > # Pruebo por si no hubo respuesta del servidor y en ese caso > uso ns4 if [ "$actual" = "" ]; then ACTUAL=$(host -R 2 -W 3 > latinloveruy.homelinux.net 213.155.150.205 | grep address | > awk '{ print $4}') fi > > # Pruebo por si no hubo respuesta del servidor y en ese caso > uso ns5 if [ "$actual" = "" ]; then ACTUAL=$(host -R 2 -W 3 > latinloveruy.homelinux.net 63.170.10.81 | grep address | awk > '{ print $4}') fi > > > #-----Port-Forwarding Variables-----# > > > #IP's a Forewardear > > #MUNDAKA="172.16.1.191" > CAMARA="192.168.15.50 " > > #----Flood Variables-----# > > # Overall Limit for TCP-SYN-Flood detection TCPSYNLIMIT="5/s" > # Burst Limit for TCP-SYN-Flood detection TCPSYNLIMITBURST="10" > > # Overall Limit for Loggging in Logging-Chains LOGLIMIT="2/s" > # Burst Limit for Logging in Logging-Chains LOGLIMITBURST="10" > > #Overall Limit for Ping-Flood-Detection > PINGLIMIT="5/s" > # Burst Limit for Ping-Flood-Detection > PINGLIMITBURST="10" > > > > #----Determinacion Automatica de la informacion para las > Interfaces-----# > > #Permite la determinacion de datos de configuracion de las interfaces > #de forma automatica permitiendo adaptarce a los cambios > logicos de la red > #sin necesidad de editar el script > ### Interface Externa (Internet-IPpublica): > > ## Obtener informacion de la Interface Externa > ## Si no encuentra una interface se pondra el valor por > defecto: DEFAULT_EXTIF como EXTIF > if [ "x$2" != "x" ]; then > EXTIF=$2 > else > EXTIF=$DEFAULT_EXTIF > fi > echo External Interface: $EXTIF > > ## Determinacion de la IP externa (publica) > EXTIP="`ifconfig $EXTIF | grep inet | cut -d : -f 2 | cut -d > \ -f 1`" > if [ "$EXTIP" = '' ]; then > echo "Aborting: Unable to determine the IP-address of $EXTIF !" > exit 1 > fi > echo External IP: $EXTIP > > ## Determincion del Gateway Externo > EXTGW=`route -n | grep -A 4 UG | awk '{ print $2}'` > echo Default GW: $EXTGW > > > echo " --- " > > > ### Interface Interna (Lan-IPprivada): > > ## Obtener informacion de la Interface InternaGet internal > interface from command-line > ## Si no encuentra una interface de pondra el valor por > defecto: $DEFAULT_INTIF as INTIF > if [ "x$3" != "x" ]; then > INTIF=$3 > else > INTIF=$DEFAULT_INTIF > fi > echo Internal Interface: $INTIF > > ## Determinacion de IP Interna > INTIP="`ifconfig $INTIF | grep inet | cut -d : -f 2 | cut -d \ -f 1`" > if [ "$INTIP" = '' ]; then > echo "Aborting: Unable to determine the IP-address of $INTIF !" > exit 1 > fi > echo Internal IP: $INTIP > > ## Determinacion de Mascara Interna > INTMASK="`ifconfig $INTIF | grep Mask | cut -d : -f 4`" > echo Internal Netmask: $INTMASK > > ## Determinacion de la Network Interna > INTLAN=$INTIP'/'$INTMASK > echo Internal LAN: $INTLAN > > echo "" > > ###--- Interface hacia la CAMARA --- > > CAMIF="eth2" > CAMIFIP="192.168.15.5 " > CAMMASK="255.255.255.0" > > ##--- Reparo problemas de ruteo --- > if [ "$(route | grep 169.254.0.0)" != "" ]; then > ip route del 169.254.0.0/16 > fi > > > #----Cargando Modulos de IPTABLES-----# > > > #Insert modules- should be done automatically if needed > > #If the IRC-modules are available, uncomment them below > > echo "Loading IPTABLES modules" > > dmesg -n 1 #Kill copyright display on module load > /sbin/modprobe ip_tables > /sbin/modprobe iptable_filter > /sbin/modprobe ip_conntrack > /sbin/modprobe ip_conntrack_ftp > /sbin/modprobe ip_nat_ftp > /sbin/modprobe ip_conntrack_irc ports=$IRCPORTS > /sbin/modprobe ip_nat_irc ports=$IRCPORTS > #dmesg -n 6 > > echo " --- " > > > #----Clear/Reset all chains-----# > > #Clear all IPTABLES-chains > > #Flush everything, start from scratch > $IPTABLES -F > $IPTABLES -F -t mangle > $IPTABLES -F -t nat > $IPTABLES -X > $IPTABLES -X -t mangle > $IPTABLES -X -t nat > > #Set default policies to DROP > $IPTABLES -P INPUT DROP > $IPTABLES -P OUTPUT DROP > $IPTABLES -P FORWARD DROP > > > #----Set network sysctl options-----# > > > echo "Setting sysctl options" > > #Enable forwarding in kernel > echo 1 > /proc/sys/net/ipv4/ip_forward > > #Disabling IP Spoofing attacks. > echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter > > #Don't respond to broadcast pings (Smurf-Amplifier-Protection) > echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts > > #Block source routing > echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route > > #Kill timestamps > echo 0 > /proc/sys/net/ipv4/tcp_timestamps > > #Enable SYN Cookies > echo 1 > /proc/sys/net/ipv4/tcp_syncookies > > #Kill redirects > echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects > > #Enable bad error message protection > echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses > > #Log martians (packets with impossible addresses) > echo 1 > /proc/sys/net/ipv4/conf/all/log_martians > > #Set out local port range > echo 32768 61000 > /proc/sys/net/ipv4/ip_local_port_range > > #Reduce DoS'ing ability by reducing timeouts > echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout > echo 2400 > /proc/sys/net/ipv4/tcp_keepalive_time > echo 0 > /proc/sys/net/ipv4/tcp_window_scaling > echo 0 > /proc/sys/net/ipv4/tcp_sack > > > echo " --- " > > echo "Creating user-chains" > > > > #----Create logging chains-----# > > ##These are the logging-chains. They all have a certain limit > of log-entries/sec to prevent log-flooding > ##The syslog-entries will be fireparse-compatible (see > http://www.fireparse.com <http://www.fireparse.com> ) > > > #Invalid packets (not ESTABLISHED,RELATED or NEW) > $IPTABLES -N LINVALID > $IPTABLES -A LINVALID -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=INVALID:1 a=DROP " --log-level info > $IPTABLES -A LINVALID -j DROP > > #TCP-Packets with one ore more bad flags > $IPTABLES -N LBADFLAG > $IPTABLES -A LBADFLAG -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=BADFLAG:1 a=DROP " --log-level info > $IPTABLES -A LBADFLAG -j DROP > > #Acceso no permitido a la Camara > $IPTABLES -N LNOCAM > $IPTABLES -A LNOCAM -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=NOCAM:1 a=DROP " > $IPTABLES -A LNOCAM -j DROP > > #Logging of connection attempts on special ports (Trojan > portscans, special services, etc.) > $IPTABLES -N LSPECIALPORT > $IPTABLES -A LSPECIALPORT -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=SPECIALPORT:1 a=DROP " --log-level info > $IPTABLES -A LSPECIALPORT -j DROP > > #Logging of possible TCP-SYN-Floods > $IPTABLES -N LSYNFLOOD > $IPTABLES -A LSYNFLOOD -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=SYNFLOOD:1 a=DROP " --log-level info > $IPTABLES -A LSYNFLOOD -j DROP > > #Logging of possible Ping-Floods > $IPTABLES -N LPINGFLOOD > $IPTABLES -A LPINGFLOOD -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=PINGFLOOD:1 a=DROP " --log-level info > $IPTABLES -A LPINGFLOOD -j DROP > > > #All other dropped packets > $IPTABLES -N LDROP > $IPTABLES -A LDROP -p tcp -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=TCP:1 > a=DROP " --log-level info > $IPTABLES -A LDROP -p udp -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=UDP:2 > a=DROP " --log-level info > $IPTABLES -A LDROP -p icmp -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=ICMP:3 > a=DROP " --log-level info > $IPTABLES -A LDROP -f -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=FRAGMENT:4 a=DROP " --log-level info > $IPTABLES -A LDROP -j DROP > > #All other rejected packets > $IPTABLES -N LREJECT > $IPTABLES -A LREJECT -p tcp -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=TCP:1 > a=REJECT " --log-level info > $IPTABLES -A LREJECT -p udp -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=UDP:2 > a=REJECT " --log-level info > $IPTABLES -A LREJECT -p icmp -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=ICMP:3 > a=REJECT " --log-level info > $IPTABLES -A LREJECT -f -m limit --limit $LOGLIMIT > --limit-burst $LOGLIMITBURST -j LOG --log-prefix > "fp=FRAGMENT:4 a=REJECT " --log-level info > $IPTABLES -A LREJECT -p tcp -j REJECT --reject-with tcp-reset > $IPTABLES -A LREJECT -p udp -j REJECT --reject-with > icmp-port-unreachable > $IPTABLES -A LREJECT -j REJECT > > #passtrue > > # $IPTABLES -A FORWARD -p tcp -s $MUNDAKA -j ACCEPT > # $IPTABLES -A FORWARD -p tcp -d $MUNDAKA -j ACCEPT > > > > > > #----Create Accept-Chains-----# > > > #TCPACCEPT - Check for SYN-Floods before letting TCP-Packets in > > $IPTABLES -N TCPACCEPT > $IPTABLES -A TCPACCEPT -p tcp --syn -m limit --limit > $TCPSYNLIMIT --limit-burst $TCPSYNLIMITBURST -j ACCEPT > $IPTABLES -A TCPACCEPT -p tcp --syn -j LSYNFLOOD > $IPTABLES -A TCPACCEPT -p tcp ! --syn -j ACCEPT > > > #----Create special User-Chains-----# > > > #CHECKBADFLAG - Kill any Inbound/Outbound TCP-Packets with > impossible flag-combinations (Some port-scanners use these, > eg. nmap Xmas,Null,etc.-scan) > > $IPTABLES -N CHECKBADFLAG > $IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL > FIN,URG,PSH -j LBADFLAG > $IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL > SYN,RST,ACK,FIN,URG -j LBADFLAG > $IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL ALL -j LBADFLAG > $IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL NONE -j LBADFLAG > $IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags SYN,RST > SYN,RST -j LBADFLAG > $IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags SYN,FIN > SYN,FIN -j LBADFLAG > > > > #FILTERING FOR SPECIAL PORTS > > > #Inbound/Outbound SILENTDROPS/REJECTS (Things we don't > want in our Logs) > > #SMB-Traffic > $IPTABLES -N SMB > > $IPTABLES -A SMB -p tcp --dport 137 -j DROP > $IPTABLES -A SMB -p tcp --dport 138 -j DROP > $IPTABLES -A SMB -p tcp --dport 139 -j DROP > $IPTABLES -A SMB -p tcp --dport 445 -j DROP > $IPTABLES -A SMB -p udp --dport 137 -j DROP > $IPTABLES -A SMB -p udp --dport 138 -j DROP > $IPTABLES -A SMB -p udp --dport 139 -j DROP > $IPTABLES -A SMB -p udp --dport 445 -j DROP > > $IPTABLES -A SMB -p tcp --sport 137 -j DROP > $IPTABLES -A SMB -p tcp --sport 138 -j DROP > $IPTABLES -A SMB -p tcp --sport 139 -j DROP > $IPTABLES -A SMB -p tcp --sport 445 -j DROP > $IPTABLES -A SMB -p udp --sport 137 -j DROP > $IPTABLES -A SMB -p udp --sport 138 -j DROP > $IPTABLES -A SMB -p udp --sport 139 -j DROP > $IPTABLES -A SMB -p udp --sport 445 -j DROP > > > #Inbound Special Ports > > $IPTABLES -N SPECIALPORTS > > #Deepthroat Scan > $IPTABLES -A SPECIALPORTS -p tcp --dport 6670 -j > LSPECIALPORT > > #Subseven Scan > $IPTABLES -A SPECIALPORTS -p tcp --dport 1243 -j > LSPECIALPORT > $IPTABLES -A SPECIALPORTS -p udp --dport 1243 > -j LSPECIALPORT > $IPTABLES -A SPECIALPORTS -p tcp --dport > 27374 -j LSPECIALPORT > $IPTABLES -A SPECIALPORTS -p udp --dport > 27374 -j LSPECIALPORT > $IPTABLES -A SPECIALPORTS -p tcp --dport 6711:6713 > -j LSPECIALPORT > > #Netbus Scan > $IPTABLES -A SPECIALPORTS -p tcp --dport > 12345:12346 -j LSPECIALPORT > $IPTABLES -A SPECIALPORTS -p tcp --dport 20034 -j > LSPECIALPORT > > #Back Orifice scan > $IPTABLES -A SPECIALPORTS -p udp --dport > 31337:31338 -j LSPECIALPORT > > #X-Win > $IPTABLES -A SPECIALPORTS -p tcp --dport $XWINPORTS > -j LSPECIALPORT > > #Hack'a'Tack 2000 > $IPTABLES -A SPECIALPORTS -p udp --dport 28431 -j LSPECIALPORT > > > #ICMP/TRACEROUTE FILTERING > > > #Inbound ICMP/Traceroute > > $IPTABLES -N ICMPINBOUND > > #Ping Flood protection. Accept $PINGLIMIT > echo-requests/sec, rest will be logged/dropped > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > echo-request -m limit --limit $PINGLIMIT --limit-burst > $PINGLIMITBURST -j ACCEPT > # > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > echo-request -j LPINGFLOOD > > #Block ICMP-Redirects (Should already be catched by > sysctl-options, if enabled) > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > redirect -j LDROP > > #Block ICMP-Timestamp (Should already be catched by > sysctl-options, if enabled) > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > timestamp-request -j LDROP > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > timestamp-reply -j LDROP > > #Block ICMP-address-mask (can help to prevent > OS-fingerprinting) > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > address-mask-request -j LDROP > $IPTABLES -A ICMPINBOUND -p icmp --icmp-type > address-mask-reply -j LDROP > > > #Allow all other ICMP in > $IPTABLES -A ICMPINBOUND -p icmp -j ACCEPT > > > > > #Outbound ICMP/Traceroute > > $IPTABLES -N ICMPOUTBOUND > > #Block ICMP-Redirects (Should already be catched by > sysctl-options, if enabled) > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > redirect -j LDROP > > #Block ICMP-TTL-Expired > #MS Traceroute (MS uses ICMP instead of UDp for tracert) > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > ttl-zero-during-transit -j LDROP > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > ttl-zero-during-reassembly -j LDROP > > #Block ICMP-Parameter-Problem > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > parameter-problem -j LDROP > > #Block ICMP-Timestamp (Should already be catched by > sysctl-options, if enabled) > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > timestamp-request -j LDROP > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > timestamp-reply -j LDROP > > #Block ICMP-address-mask (can help to prevent > OS-fingerprinting) > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > address-mask-request -j LDROP > $IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type > address-mask-reply -j LDROP > > > ##Accept all other ICMP going out > $IPTABLES -A ICMPOUTBOUND -p icmp -j ACCEPT > > > # CHAIN PARA LA SEPARACION DE TRAFICO BASADO EN LA IP DE > ORIGEN DE LA LAN > > $IPTABLES -t mangle -N SETEAMARCA > $IPTABLES -t mangle -A SETEAMARCA -s $A1 -j MARK --set-mark 1 > $IPTABLES -t mangle -A SETEAMARCA -s $A2 -j MARK --set-mark 2 > $IPTABLES -t mangle -A SETEAMARCA -s $A3 -j MARK --set-mark 3 > $IPTABLES -t mangle -A SETEAMARCA -s $A4 -j MARK --set-mark 4 > $IPTABLES -t mangle -A SETEAMARCA -s $A5 -j MARK --set-mark 5 > $IPTABLES -t mangle -A SETEAMARCA -s $A6 -j MARK --set-mark 6 > $IPTABLES -t mangle -A SETEAMARCA -s $A7 -j MARK --set-mark 7 > $IPTABLES -t mangle -A SETEAMARCA -s $A8 -j MARK --set-mark 8 > $IPTABLES -t mangle -A SETEAMARCA -s $B1 -j MARK --set-mark 9 > $IPTABLES -t mangle -A SETEAMARCA -s $B2 -j MARK --set-mark 10 > $IPTABLES -t mangle -A SETEAMARCA -s $B3 -j MARK --set-mark 11 > $IPTABLES -t mangle -A SETEAMARCA -s $B4 -j MARK --set-mark 12 > $IPTABLES -t mangle -A SETEAMARCA -s $B5 -j MARK --set-mark 13 > $IPTABLES -t mangle -A SETEAMARCA -s $B6 -j MARK --set-mark 14 > $IPTABLES -t mangle -A SETEAMARCA -s $J1 -j MARK --set-mark 15 > $IPTABLES -t mangle -A SETEAMARCA -s $J2 -j MARK --set-mark 16 > $IPTABLES -t mangle -A SETEAMARCA -s $J3 -j MARK --set-mark 17 > $IPTABLES -t mangle -A SETEAMARCA -s $J4 -j MARK --set-mark 18 > $IPTABLES -t mangle -A SETEAMARCA -s $J5 -j MARK --set-mark 19 > $IPTABLES -t mangle -A SETEAMARCA -s $J6 -j MARK --set-mark 20 > $IPTABLES -t mangle -A SETEAMARCA -s $JEJE -j MARK --set-mark 21 > # $IPTABLES -t mangle -A SETEAMARCA -s $CAMARA -j MARK > --set-mark 22 > > > #----End User-Chains-----# > > > > echo " --- " > > > #----Start Ruleset-----# > > echo "Implementing firewall rules..." > > > ################# > ## INPUT-Chain ## (everything that is addressed to the > firewall itself) > ################# > > > ##GENERAL Filtering > > # Kill INVALID packets (not ESTABLISHED, RELATED or NEW) > $IPTABLES -A INPUT -m state --state INVALID -j LINVALID > > # Check TCP-Packets for Bad Flags > $IPTABLES -A INPUT -p tcp -j CHECKBADFLAG > > > ##Packets FROM FIREWALL-BOX ITSELF > > #Local IF > $IPTABLES -A INPUT -i lo -j ACCEPT > # > #Kill connections to the local interface from the outside > world (--> Should be already catched by kernel/rp_filter) > $IPTABLES -A INPUT -d 127.0.0.0/8 -j LREJECT > > > ##Packets FROM INTERNAL NET > > > ##Allow unlimited traffic from internal network using legit > addresses to firewall-box > ##If protection from the internal interface is needed, alter it > > $IPTABLES -A INPUT -i $INTIF -s $INTLAN -j ACCEPT > #Kill anything from outside claiming to be from internal > network (Address-Spoofing --> Should be already catched by rp_filter) > $IPTABLES -A INPUT -s $INTLAN -j LREJECT > $IPTABLES -A INPUT -i $EXTIF -s $INTLAN -j LREJECT > > > > ##Packets FROM EXTERNAL NET > > > ##ICMP & Traceroute filtering > > #Filter ICMP > $IPTABLES -A INPUT -i $EXTIF -p icmp -j ICMPINBOUND > > #Block UDP-Traceroute > $IPTABLES -A INPUT -p udp --dport 33434:33523 -j LDROP > > > ##Silent Drops/Rejects (Things we don't want in our logs) > > #Drop all SMB-Traffic > $IPTABLES -A INPUT -i $EXTIF -j SMB > > #Silently reject Ident (Don't DROP ident, because of > possible delays when establishing an outbound connection) > $IPTABLES -A INPUT -i $EXTIF -p tcp --dport 113 -j REJECT > --reject-with tcp-reset > > > ##Public services running ON FIREWALL-BOX (comment out to activate): > > > > # ftp-data > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 20 -j TCPACCEPT > > # ftp > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 21 -j TCPACCEPT > > # ssh > $IPTABLES -A INPUT -i $EXTIF -p tcp --dport 22 -j TCPACCEPT > > #telnet > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 23 -j TCPACCEPT > > > # smtp > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 25 -j ACCEPT > > # webmail > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 26 -j TCPACCEPT > > # DNS > $IPTABLES -A INPUT -i $EXTIF -p tcp --dport 53 -j TCPACCEPT > $IPTABLES -A INPUT -i $EXTIF -p udp --dport 53 -j ACCEPT > > # http > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 80 -j TCPACCEPT > > # https > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 443 -j TCPACCEPT > > # POP-3 > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 110 -j TCPACCEPT > > # Bnc > #$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 31337 -j TCPACCEPT > > > ##Separate logging of special portscans/connection attempts > > $IPTABLES -A INPUT -i $EXTIF -j SPECIALPORTS > > > > ##Allow ESTABLISHED/RELATED connections in > > $IPTABLES -A INPUT -i $EXTIF -m state --state ESTABLISHED -j ACCEPT > $IPTABLES -A INPUT -i $EXTIF -p tcp --dport $UNPRIVPORTS -m > state --state RELATED -j TCPACCEPT > $IPTABLES -A INPUT -i $EXTIF -p udp --dport $UNPRIVPORTS -m > state --state RELATED -j ACCEPT > > > ##Catch all rule > $IPTABLES -A INPUT -j LDROP > > > > > > ################## > ## Output-Chain ## (everything that comes directly from the > Firewall-Box) > ################## > > > > ##Packets TO FIREWALL-BOX ITSELF > > #Local IF > $IPTABLES -A OUTPUT -o lo -j ACCEPT > > > ##Packets TO INTERNAL NET > > #Allow unlimited traffic to internals networks using legit > addresses > $IPTABLES -A OUTPUT -o $INTIF -d $INTLAN -s $INTIP -j ACCEPT > $IPTABLES -A OUTPUT -o $CAMIF -d $CAMARA -s $CAMIFIP -j ACCEPT > > > > ##Packets TO EXTERNAL NET > > > ##ICMP & Traceroute > > $IPTABLES -A OUTPUT -o $EXTIF -p icmp -j ICMPOUTBOUND > > > > ##Silent Drops/Rejects (Things we don't want in our logs) > > #SMB > $IPTABLES -A OUTPUT -o $EXTIF -j SMB > > #Ident > $IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 113 -j REJECT > --reject-with tcp-reset > > > > ##Public services running ON FIREWALL-BOX (comment out to activate): > > # ftp-data > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 20 -j ACCEPT > > # ftp > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 21 -j ACCEPT > > # ssh > $IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 22 -m state > --state ESTABLISHED -j ACCEPT > > #telnet > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 23 -m state > --state ESTABLISHED -j ACCEPT > > # smtp > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 25 -m state > --state ESTABLISHED -j ACCEPT > > # webmail > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 88 -j ACCEPT > > # DNS > $IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 53 -j ACCEPT > $IPTABLES -A OUTPUT -o $EXTIF -p udp --sport 53 -j ACCEPT > > # http > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 80 -m state > --state ESTABLISHED -j ACCEPT > > # https > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 443 -m state > --state ESTABLISHED -j ACCEPT > > # POP-3 > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 110 -m state > --state ESTABLISHED -j ACCEPT > > #Netmeeting > $IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 1720 -j ACCEPT > $IPTABLES -A OUTPUT -o $EXTIF -p udp --sport 1720 -j ACCEPT > > #BNC > #$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 31337 -j ACCEPT > > > > ##Accept all tcp/udp traffic on unprivileged ports going out > > $IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -p tcp --sport > $UNPRIVPORTS -j ACCEPT > $IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -p udp --sport > $UNPRIVPORTS -j ACCEPT > > > ##Darle una via privada de salida a paquetes del firewall itself > $IPTABLES -t mangle -A OUTPUT -o $EXTIF -s $EXTIP -j MARK > --set-mark 23 > > > ##Catch all rule > > $IPTABLES -A OUTPUT -j LDROP > > > > > #################### > ## FORWARD-Chain ## (everything that passes the firewall) > #################### > > > ##GENERAL Filtering > > #Kill invalid packets (not ESTABLISHED, RELATED or NEW) > $IPTABLES -A FORWARD -m state --state INVALID -j LINVALID > > # Check TCP-Packets for Bad Flags > $IPTABLES -A FORWARD -p tcp -j CHECKBADFLAG > > ##Filtering FROM INTERNAL NET > > > ##Silent Drops/Rejects (Things we don't want in our logs) > > #SMB > $IPTABLES -A FORWARD -o $EXTIF -j SMB > > > ##Special Drops/Rejects > # - To be done - > > > ##Filter for some Trojans communicating to outside > # - To be done - > > > ##Port-Forwarding from Ports < 1024 [outbound] (--> Also > see chain PREROUTING) > > #Forwarding a mundaka > #$IPTABLES -A FORWARD -o $EXTIF -s $SAND2002 -p tcp > --sport 25 -j ACCEPT > > > > ##Allow all other forwarding (from Ports > 1024) from > Internals Net's to External Net > $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s $INTLAN -p tcp > --sport $UNPRIVPORTS -j ACCEPT > $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s $INTLAN -p udp > --sport $UNPRIVPORTS -j ACCEPT > $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s $INTLAN -p icmp > -j ACCEPT > $IPTABLES -A FORWARD -i $CAMIF -o $EXTIF -s $CAMARA -d > $ACTUAL -p tcp --sport 9090 -j ACCEPT > > > ##Filtering FROM EXTERNAL NET > > > ##Silent Drops/Rejects (Things we don't want in our logs) > > #SMB > $IPTABLES -A FORWARD -i $EXTIF -j SMB > > > ##Allow replies coming in > $IPTABLES -A FORWARD -i $EXTIF -m state --state ESTABLISHED > -j ACCEPT > $IPTABLES -A FORWARD -i $EXTIF -p tcp --dport $UNPRIVPORTS > -m state --state RELATED -j TCPACCEPT > $IPTABLES -A FORWARD -i $EXTIF -p udp --dport $UNPRIVPORTS > -m state --state RELATED -j ACCEPT > $IPTABLES -A FORWARD -i $EXTIF -p icmp -m state --state > RELATED -j ACCEPT > > > ##Port-Forwarding [inbound] (--> Also see chain PREROUTING) > > #Forwarding > #$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $MUNDAKA --dport > 80 -j ACCEPT > #$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $MUNDAKA --dport > 22 -j ACCEPT > #$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $SAND2002 --dport > 25 -j ACCEPT > $IPTABLES -A FORWARD -i $EXTIF -o $CAMIF -s $ACTUAL -d > $CAMARA -p tcp --dport 9090 -j ACCEPT > > ##Some ip forward > > # $IPTABLES -A FORWARD -p tcp -s $MUNDAKA -j ACCEPT > # $IPTABLES -A FORWARD -p tcp -d $MUNDAKA -j ACCEPT > > ## Forward entre las redes internas > $IPTABLES -A FORWARD -s $CAMARA -i $CAMIF -o $INTIF -d > $INTLAN -p tcp --sport 9090 -j ACCEPT > $IPTABLES -A FORWARD -d $CAMARA -o $CAMIF -i $INTIF -s > $INTLAN -p tcp --dport 9090 -j ACCEPT > > ## Cortar comunicacion Cyber-Cam (todo lo que vaya o venga a > la Cam, y que no me halla > ## interesado admitir antes, es logeado y luego muere) > $IPTABLES -A FORWARD -o $CAMIF -j LNOCAM > $IPTABLES -A FORWARD -i $CAMIF -j LNOCAM > > ##Catch all rule/Deny every other forwarding > > $IPTABLES -A FORWARD -j LDROP > > ################ > ## PREROUTING ## > ################ > > ##Port-Forwarding (--> Also see chain FORWARD) > > #Puertos Trasladados > # $IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF -d $EXTIP > --dport 25 -j DNAT --to-destination $SAND2002 > $IPTABLES -t nat -A PREROUTING -i $EXTIF -d $EXTIP -s > $ACTUAL -p tcp --dport 9090 -j DNAT --to-destination $CAMARA > > > > ################### > ## POSTROUTING ## > ################### > > #Seteo de marca basado en la dirección de origen > $IPTABLES -t mangle -A POSTROUTING -s $INTLAN -o $EXTIF -j > SETEAMARCA > $IPTABLES -t mangle -A POSTROUTING -o $EXTIF -s $CAMARA -j > MARK --set-mark 22 > > #Masquerade from Internal Net to External Net > > $IPTABLES -t nat -A POSTROUTING -o $EXTIF -s $INTLAN -j > SNAT --to-source $EXTIP > $IPTABLES -t nat -A POSTROUTING -o $EXTIF -s $CAMARA -j > SNAT --to-source $EXTIP > #$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE > > > > #------End Ruleset------# > > echo "...done" > echo "" > > > echo "--> IPTABLES firewall loaded/activated <--" > > > ##--------------------------------End > Firewall---------------------------------## > > > > ;; > *) > echo "Usage: firewall (start|stop|restart|status) EXTIF INTIF" > exit 1 > esac > > exit 0 > > > >

1 0

Tyan K8SRE troubles with CentOS 4.4 i386
by Dan Halbert 19 Dec '06

19 Dec '06

We have been seeing failures with CentOS 4.4 i386 (not x86_64) running compute-intensive programs on Tyan K8SRE (S2891) Tymotherboards, running Opteron 265's. This motherboard is used in the Tyan barebones box GT24 (B2881). We have these boards populated with 8GB of RAM, consisting of mixed 2GB and 1GB sticks. The symptom is that CPU-bound programs (may or may not be related to floating point) fail randomly and intermittently, with wrong answers or segfaults. Running several in parallel seems to make the failures more likely. We have not seen any kernel crashes. It is not hard to reproduce the problem with some internal programs we have; it takes only a few minutes. This is using a completely-up-to-date-as-of-yesterday CentOS 4.4 i386, hugemem or not doesn't make a difference. We have seen this on many boxes, so it's not bad memory. We do NOT see this problem if we run CentOS 4.4 x86_64 on the same boxes, using the same 32-bit test executables. We also don't see this problem on some slightly older boxes with Tyan K8SD motherboards running CentOS 4.4 i386 (also Opteron 265's, with 8GB of 1GB DIMMs). We have been looking at BIOS settings, but haven't seen anything that stands out. memtest86 does not show errors. Thanks for any suggestions of what this issue might be, Dan

6 22

RE: [CentOS] How to connect to a Windows PC in LAN
by Wright, Paul 18 Dec '06

18 Dec '06

>I have a LAN with 2 computers: One is CentOS and one is Windows XP. >I am trying to transfer file between 2 computers using LAN. Can you >please tell me how to do it? For quick informal file transfers between Windows and Linux, I use a program called WinSCP installed on the Windows box (find it as winscp.sourceforge.net) As long as your Linux box will accept SSH sessions, it works really well and gives you the familiar Explorer-type interface. Regards, Paul

1 0

RE: [CentOS] Mail Server instalation package?
by Alex Palenschat 18 Dec '06

18 Dec '06

> > I don't see any package called "Mail Server" when I execute > su -c "yum grouplist". Hmmm... I do. What version of yum and CentOS are you using. I'm on 4.4. alex

1 0

Intel 965 Chipset on 4.4 ?
by Redhat Admin 18 Dec '06

18 Dec '06

I have a nice new 965 chipset mobo with core 2 duo cpu. I was wondering if anyone has any experiences with this chipset and CPU with 4.4 ? Does the jmicron sata/pata interface work ? Are both cores recongnized with the right kernel ? Does EIST work ? Or should I wait for Centos 5 ? Cheers, Brian.

6 10

bring back sub shells
by Dustin Krysak 16 Dec '06

16 Dec '06

Good day, I have a centos 4.4 box (all yumed up). Now i have a program that has a sub shell - meaning something like the mysql command line, where once started it takes it's own commands, etc and keeps running until a "quit" command is issued. Now what I was wondering - is there a way to fork it to the background (something like # command & or ctrl -z) and have the subshell keep running? And also to be able to get back to the sub shell? For example, if i do run it with the & at the end it does what I want, yet obviously (to my knowledge) you can't get back to the subshell without killing it and restarting it. I have looked into the "screen" shell utility, which for the most part does what I needed, however after a few days the session had disappeared and I was not able to get back to it from another machine/ssh session. Are there any other options? Thanks! Dustin

7 9

nVidia-driver
by Timothy Kesten 16 Dec '06

16 Dec '06

Hi Folks, there are knowing problems with nVidia drivers? I intend to use it. I have a nVidia GeForce4 and using CentOS 4.4 Thanks Timothy

2 2

Re: [CentOS] Help With Installation to USB Stick
by Mark Rose 15 Dec '06

15 Dec '06

Not a problem. If I need to add USB functionality into the kernel - the next question is what are the steps involved to do this? I was under the impression that running mkinitrd was all that needed to be done. Of course, I did run it and still got the same errors. Mark ---- Pierre Bourgin <pierre.bourgin(a)arteris.com> wrote: > Hello, > > It sounds like you forgot to label your / partition (/dev/sda2) as "/". > > As a workaround, interrupt the grub loader and edit the boot command line > from > kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet > to > kernel /vmlinuz-2.6.9-42.EL ro root=/dev/sda2 rhgb quiet > > you should then be abble to boot the kernel and get a minimal shell, but > probably failed to mount "/" ie finish the boot process : /etc/fstab may > also mention "LABEL=/" instead of "/dev/sda2" for / FS. > > To fix it, 2 solutions: > > * once booted, (mount and) modify /boot/grub/grub.conf to modify the kernel > boot parameters as did to boot and also the /etc/fstab. > > * or label your root partition as "/" to match the kernel options in grub. > the command to do it is: > e2label /dev/sda2 "/" > I'm not sure you can do it on your running system (ie /dev/sda2 mounted), > you should use a rescue system to do it. > > Hope this help, > > Pierre Bourgin > > > Mark Rose a écrit : > > Recently, I was able to create a workable Centos 4.4 "Live USB" on my 1G > > Lexar Firefly pendrive using the steps in > > http://linux.web.psi.ch/livecd/usbdisk.html. At the moment, it is doing its > > job, so I probably won't focus too much more on it. One thing that is > > annoying, although doesn't cause a problem is that on powerdown and reboot, > > the cd rom drive ejects - of course, there is no CD in it! > > > > My ultimate goal is to get a standard, updatable 4.4 install onto my 4G > > Firefly, I am at a loss as to why I get the following errors: > > > > *************************************** > > > > Booting 'CentOS-4 i386 (2.6.9-42.EL)' > > > > root (hd0,0) > > Filesystem type is ext2fs, partition type 0x83 > > kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet > > [Linux-bzImage, setup=0x1400, size=0x16dd65] > > initrd /initrd-2.6.9-42.EL.img > > [Linux-initrd @ 0x1fefe000, 0x612ef bytes] > > > > Uncompressing Linux... Ok, booting the kernel. > > Red Hat nash version 4.2.1.8 starting > > mkrootdev: label / not found > > mount: error 2 mounting ext3 > > mount: error 2 mounting none > > switchroot: mount failed: 22 > > umount /initrd/dev failed: 2 > > Kernel panic - not syncing: Attempted to kill init! > > > > *************************************** > > > > This is what I did: > > > > - installed CentOS 4.4 from CDs using "expert mode" > > - grub bootloader > > - /dev/sda1 mounted on /boot 100M > > - /dev/sda2 mounted on / 3.9G > > - no swap > > - server install (w/gdm) > > > > It was suggested that I may be having an issue with USB drivers not getting installed, so I ran mkinitrd including them. I also uncompressed initrd.gz and tried to add them manually - I had no luck with either method. > > > > Since I am by no means a Linux expert (my background is in data and voice networking), any and all suggestions and URLs will be appreciated! > > > > Mark > > > > _______________________________________________ > > CentOS mailing list > > CentOS(a)centos.org > > http://lists.centos.org/mailman/listinfo/centos > > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos

1 0

recompiling LVM or move to GFS for MySQL?
by Jed Reynolds 15 Dec '06

15 Dec '06

I'm planning some new mysql database servers and I've had problems with LVM in the past with snapshots. I've had advice from someone from MySQL AB to try out GFS because it's snapshotting is supposed not to be broken. Looking at some of the GFS documentation on Redhat.com makes it look like GFS might be or might not be a simple replacement if I'm just mounting it locally, but I've never tried it out. On the other hand, I've seen posts saying that if I do something like a rpm rebuild of LVM and udev and somesuch LVM snapshotting should work. I'd prefer to run a server configuration where I could do a scripted server build without having to install GCC and rebuild RPM packages when it came time to do a reinstall or create another replica server. Is LVM snapshotting going to busted forever, and should I go for GFS locally mounted? Jed

3 4

Re: [CentOS] Help With Installation to USB Stick
by Mark Rose 15 Dec '06

15 Dec '06

I went ahead and verified the labels on my partitions, and /dev/sda2 is labelled "/" and /dev/sda1 has a label of "/boot". Like I previously mentioned, I believe /boot is fine since grub loads - I am still at a loss as to why it can not see /. I installed the pendrive into my home PC running 4.4 and /dev/sda2 looks fine. I also ran fsck on it and it is clean. A while back, it was suggested that I run mkinitrd and include the USB drivers. I tried this, but it still wasn't recognized. If anyone can help me get pointed in the right direction, it will be greatly appreciated. Thanks! Mark ---- Pierre Bourgin <pierre.bourgin(a)arteris.com> wrote: > Hello, > > It sounds like you forgot to label your / partition (/dev/sda2) as "/". > > As a workaround, interrupt the grub loader and edit the boot command line > from > kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet > to > kernel /vmlinuz-2.6.9-42.EL ro root=/dev/sda2 rhgb quiet > > you should then be abble to boot the kernel and get a minimal shell, but > probably failed to mount "/" ie finish the boot process : /etc/fstab may > also mention "LABEL=/" instead of "/dev/sda2" for / FS. > > To fix it, 2 solutions: > > * once booted, (mount and) modify /boot/grub/grub.conf to modify the kernel > boot parameters as did to boot and also the /etc/fstab. > > * or label your root partition as "/" to match the kernel options in grub. > the command to do it is: > e2label /dev/sda2 "/" > I'm not sure you can do it on your running system (ie /dev/sda2 mounted), > you should use a rescue system to do it. > > Hope this help, > > Pierre Bourgin > > > Mark Rose a écrit : > > Recently, I was able to create a workable Centos 4.4 "Live USB" on my 1G > > Lexar Firefly pendrive using the steps in > > http://linux.web.psi.ch/livecd/usbdisk.html. At the moment, it is doing its > > job, so I probably won't focus too much more on it. One thing that is > > annoying, although doesn't cause a problem is that on powerdown and reboot, > > the cd rom drive ejects - of course, there is no CD in it! > > > > My ultimate goal is to get a standard, updatable 4.4 install onto my 4G > > Firefly, I am at a loss as to why I get the following errors: > > > > *************************************** > > > > Booting 'CentOS-4 i386 (2.6.9-42.EL)' > > > > root (hd0,0) > > Filesystem type is ext2fs, partition type 0x83 > > kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet > > [Linux-bzImage, setup=0x1400, size=0x16dd65] > > initrd /initrd-2.6.9-42.EL.img > > [Linux-initrd @ 0x1fefe000, 0x612ef bytes] > > > > Uncompressing Linux... Ok, booting the kernel. > > Red Hat nash version 4.2.1.8 starting > > mkrootdev: label / not found > > mount: error 2 mounting ext3 > > mount: error 2 mounting none > > switchroot: mount failed: 22 > > umount /initrd/dev failed: 2 > > Kernel panic - not syncing: Attempted to kill init! > > > > *************************************** > > > > This is what I did: > > > > - installed CentOS 4.4 from CDs using "expert mode" > > - grub bootloader > > - /dev/sda1 mounted on /boot 100M > > - /dev/sda2 mounted on / 3.9G > > - no swap > > - server install (w/gdm) > > > > It was suggested that I may be having an issue with USB drivers not getting installed, so I ran mkinitrd including them. I also uncompressed initrd.gz and tried to add them manually - I had no luck with either method. > > > > Since I am by no means a Linux expert (my background is in data and voice networking), any and all suggestions and URLs will be appreciated! > > > > Mark > > > > _______________________________________________ > > CentOS mailing list > > CentOS(a)centos.org > > http://lists.centos.org/mailman/listinfo/centos > > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos

1 0

Desktop link to URL with port number fails in CentOS 4.4
by Edward Diener 15 Dec '06

15 Dec '06

If I create a desktop item which is a link to a URL with a port number, opening the desktop item fails. I can create the desktop item by dragging and dropping the URL from my web browser, firefox. The desktop item, when I attempt to open it, brings up a message box with the title "Cancel Open?", a lightbulb icon, a message "Opening 'myURL:myPort'. You can stop this operation by clicking cancel.", and a single Cancel button. If I type directly into a terminal "firefox http://myURL:myPort/", firefox will correctly open that web page ( firefox is my preferred web browser ). So this is not a firefox problem but a Gnome desktop link problem evidently. Other URLs without a port number open correctly from a desktop link. Is there a way to fix this ? It probably has something to do with interpreting the URL as a Mime type for Gnome, but I do not know how I can correct the behavior so that URLs with port numbers are correctly passed to my preferred web browser, firefox.

1 0

YUM KeyError: 'epoch'
by Shawn Flack 15 Dec '06

15 Dec '06

Hello, I am running Centos 4 fully updated (as of 1 week ago) I tried to use yum last night and I got this error: [root@localhost share]# yum update Setting up Update Process Setting up repositories update 100% |=========================| 951 B 00:00 rpmforge 100% |=========================| 1.1 kB 00:00 base 100% |=========================| 1.1 kB 00:00 addons 100% |=========================| 951 B 00:00 extras 100% |=========================| 1.1 kB 00:00 Reading repository metadata in from local files rpmforge : 1/6408Traceback (most recent call last): File "/usr/bin/yum", line 29, in ? yummain.main(sys.argv[1:]) File "/usr/share/yum-cli/yummain.py", line 97, in main result, resultmsgs = do() File "/usr/share/yum-cli/cli.py", line 477, in doCommands return self.updatePkgs() File "/usr/share/yum-cli/cli.py", line 955, in updatePkgs self.doRepoSetup() File "/usr/share/yum-cli/cli.py", line 75, in doRepoSetup self.doSackSetup(thisrepo=thisrepo) File "__init__.py", line 260, in doSackSetup File "repos.py", line 287, in populateSack File "sqlitecache.py", line 96, in getPrimary File "sqlitecache.py", line 89, in _getbase File "sqlitecache.py", line 359, in updateSqliteCache File "sqlitecache.py", line 251, in addPrimary File "sqlitecache.py", line 197, in insertHash File "sqlitecache.py", line 449, in values File "sqlitecache.py", line 441, in __getitem__ File "mdparser.py", line 73, in __getitem__ KeyError: 'epoch' I removed yum and re-installed it from the RPM on the install disk. I googled but I did not find anything that made sense to me. Thank you for any help anyone can provide. Shawn Flack

1 0

Dag mirror, yum and repomd.xml!
by israel.garcia＠cimex.com.cu 15 Dec '06

15 Dec '06

Hi: I have a mirror of dag repository (http://apt.sw.be/redhat/el4/en/i386/dag/) in my intranet which is used by other servers to install/update rpms. I installed on every remote server the rpmforge rpm, edit the /etc/yum.repos.d/rpmforge.repo to fit with my intranet mirror, but when I run yum, I get this error: #yum -c rpmforge.repo search nagios Warning, could not load sqlite, falling back to pickle Repository rpmforge is listed more than once in the configuration Searching Packages: Setting up repositories //var/cache/yum/rpmforge/repomd.xml:1: parser error : Document is empty ^ //var/cache/yum/rpmforge/repomd.xml:1: parser error : Start tag expected, '<' not found ^ rpmforge 0 B 00:00 ftp://repository.cimex.com.cu/dag/repodata/repomd.xml: [Errno -1] Error importing repomd.xml for rpmforge: Error: could not parse file //var/cache/yum/rpmforge/repomd.xml Trying other mirror. Cannot open/read repomd.xml file for repository: rpmforge failure: repodata/repomd.xml from rpmforge: [Errno 256] No more mirrors to try. Error: failure: repodata/repomd.xml from rpmforge: [Errno 256] No more mirrors to try. Am I missing some step? What's wrong with my configuration? Regards; Israel

4 4

Centos 4.x and embeded x86 (wrap, pcengines)
by Oliver Schulze L. 14 Dec '06

14 Dec '06

Hi, I'm looking for info about installing centos 4.4 on an embedded platform, like wrap's pcengines or similar. Anyone has done that? Any links? Thanks Oliver -- Oliver Schulze L. | Get my e-mail after a captcha in: Asuncion - Paraguay | http://tinymailto.com/oliver

9 19

Getting kernel source for 2.6.9-42.ELsmp
by Charles E Campbell Jr 14 Dec '06

14 Dec '06

Hello! I need to get an arcnet device driver up and running. Normally it appears to be distributed with linux, but not installed. So, I need to compile and install it, naturally. So, where is the kernel souce for 2.6.9-42.ELsmp? I can find kernel source for 2.6.9. BTW, I obtained 2.6.9 and tried compiling it, but all I got was *.o files and insmod: error inserting 'arcnet.o`: -1 Invalid module format Seems that the rest of the /lib/modules/2.6.9-42.ELsmp/kernel/drivers/net appear to be *.ko files. Hope y'all can help! Charles Campbell

8 11

perl-libnet question
by D Ivago 14 Dec '06

14 Dec '06

*Hi all, does somebody know where I can find perl-libnet rpm for centos 4.3 with perl-5.8.5-16.RHEL4.x86_64.rpm Tried dag's repo wich has alot of perl modules but unfortuneately hasn't got perl-libnet, just an empty dir http://dag.wieers.com/packages/perl-libnet/ thanks in advance! Ivqgo *

2 1

New VLC (0.8.6) packages?
by chrism＠imntv.com 14 Dec '06

14 Dec '06

Anyone know where I could find this package for Centos 4.4 x86_64? I've googled all over and haven't been able to find anything more current the 0.8.4a. I'm not much of a programmer, but if someone could point me at a "packaging for dummies" perhaps I could have a go at creating a package if one doesn't already exist? Cheers,

3 4

Re: [CentOS] Help With Installation to USB Stick
by Mark Rose 14 Dec '06

14 Dec '06

Hi: Thanks for the advice. I think I did try this (actually, I believe when I went through the CentOS install (graphical if it makes any difference) by default it labelled it as /. I am hoping tonight or tomorrow to try to do another install and will give it a shot! Mark ---- Pierre Bourgin <pierre.bourgin(a)arteris.com> wrote: > Hello, > > It sounds like you forgot to label your / partition (/dev/sda2) as "/". > > As a workaround, interrupt the grub loader and edit the boot command line > from > kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet > to > kernel /vmlinuz-2.6.9-42.EL ro root=/dev/sda2 rhgb quiet > > you should then be abble to boot the kernel and get a minimal shell, but > probably failed to mount "/" ie finish the boot process : /etc/fstab may > also mention "LABEL=/" instead of "/dev/sda2" for / FS. > > To fix it, 2 solutions: > > * once booted, (mount and) modify /boot/grub/grub.conf to modify the kernel > boot parameters as did to boot and also the /etc/fstab. > > * or label your root partition as "/" to match the kernel options in grub. > the command to do it is: > e2label /dev/sda2 "/" > I'm not sure you can do it on your running system (ie /dev/sda2 mounted), > you should use a rescue system to do it. > > Hope this help, > > Pierre Bourgin > > > Mark Rose a écrit : > > Recently, I was able to create a workable Centos 4.4 "Live USB" on my 1G > > Lexar Firefly pendrive using the steps in > > http://linux.web.psi.ch/livecd/usbdisk.html. At the moment, it is doing its > > job, so I probably won't focus too much more on it. One thing that is > > annoying, although doesn't cause a problem is that on powerdown and reboot, > > the cd rom drive ejects - of course, there is no CD in it! > > > > My ultimate goal is to get a standard, updatable 4.4 install onto my 4G > > Firefly, I am at a loss as to why I get the following errors: > > > > *************************************** > > > > Booting 'CentOS-4 i386 (2.6.9-42.EL)' > > > > root (hd0,0) > > Filesystem type is ext2fs, partition type 0x83 > > kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet > > [Linux-bzImage, setup=0x1400, size=0x16dd65] > > initrd /initrd-2.6.9-42.EL.img > > [Linux-initrd @ 0x1fefe000, 0x612ef bytes] > > > > Uncompressing Linux... Ok, booting the kernel. > > Red Hat nash version 4.2.1.8 starting > > mkrootdev: label / not found > > mount: error 2 mounting ext3 > > mount: error 2 mounting none > > switchroot: mount failed: 22 > > umount /initrd/dev failed: 2 > > Kernel panic - not syncing: Attempted to kill init! > > > > *************************************** > > > > This is what I did: > > > > - installed CentOS 4.4 from CDs using "expert mode" > > - grub bootloader > > - /dev/sda1 mounted on /boot 100M > > - /dev/sda2 mounted on / 3.9G > > - no swap > > - server install (w/gdm) > > > > It was suggested that I may be having an issue with USB drivers not getting installed, so I ran mkinitrd including them. I also uncompressed initrd.gz and tried to add them manually - I had no luck with either method. > > > > Since I am by no means a Linux expert (my background is in data and voice networking), any and all suggestions and URLs will be appreciated! > > > > Mark > > > > _______________________________________________ > > CentOS mailing list > > CentOS(a)centos.org > > http://lists.centos.org/mailman/listinfo/centos > > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos

1 0

/var/log/secure timestamp
by Andres Baravalle 14 Dec '06

14 Dec '06

Hi everyone, I have some very strange information in my /var/log/secure: find /var/log | xargs grep -i 62.149.129.73 2>/dev/null /var/log/secure:Dec 13 21:32:38 baravalle xinetd[1219]: START: smtp pid=26049 from=62.149.129.73 /var/log/secure:Dec 13 21:32:38 baravalle sshd[26048]: Did not receive identification string from ::ffff:62.149.129.73 /var/log/secure:Dec 13 20:33:33 baravalle sshd[26059]: Failed none for invalid user admin1000000 from ::ffff:62.149.129.73 port 3754 ssh2 /var/log/secure:Dec 13 21:33:42 baravalle sshd[26058]: Failed password for invalid user admin1000000 from ::ffff:62.149.129.73 port 3754 ssh2 /var/log/secure:Dec 13 20:33:42 baravalle sshd[26059]: Failed password for invalid user admin1000000 from ::ffff:62.149.129.73 port 3754 ssh2 Apparently someone tried to log in with a user name (I changed the username here). I don't like the timestamps: 21:32:38, 20:33:33, 21:33:42, 20:33:42. Why is that? By the way, most probably the access has been done by my provider. They are denying it, but there is overwhelming evidence: the username used is the one that they gave me, which is the word admin and a string of 7 digits. The username should be known just by me, my business partner and my provider. The username was anyway invalid in the system, because I had disabled SSH access from all users but the ones in a group. Nevertheless, in their records, the provider had another user name that I didn't disable (stupid me) because they did some maintenance work not long ago. I can't see any access from the correct user name since the last time I had authorised them to access the server. Anyone able to bring some light? Andres

3 3

Help With Installation to USB Stick
by Mark Rose 14 Dec '06

14 Dec '06

Recently, I was able to create a workable Centos 4.4 "Live USB" on my 1G Lexar Firefly pendrive using the steps in http://linux.web.psi.ch/livecd/usbdisk.html. At the moment, it is doing its job, so I probably won't focus too much more on it. One thing that is annoying, although doesn't cause a problem is that on powerdown and reboot, the cd rom drive ejects - of course, there is no CD in it! My ultimate goal is to get a standard, updatable 4.4 install onto my 4G Firefly, I am at a loss as to why I get the following errors: *************************************** Booting 'CentOS-4 i386 (2.6.9-42.EL)' root (hd0,0) Filesystem type is ext2fs, partition type 0x83 kernel /vmlinuz-2.6.9-42.EL ro root=LABEL=/ rhgb quiet [Linux-bzImage, setup=0x1400, size=0x16dd65] initrd /initrd-2.6.9-42.EL.img [Linux-initrd @ 0x1fefe000, 0x612ef bytes] Uncompressing Linux... Ok, booting the kernel. Red Hat nash version 4.2.1.8 starting mkrootdev: label / not found mount: error 2 mounting ext3 mount: error 2 mounting none switchroot: mount failed: 22 umount /initrd/dev failed: 2 Kernel panic - not syncing: Attempted to kill init! *************************************** This is what I did: - installed CentOS 4.4 from CDs using "expert mode" - grub bootloader - /dev/sda1 mounted on /boot 100M - /dev/sda2 mounted on / 3.9G - no swap - server install (w/gdm) It was suggested that I may be having an issue with USB drivers not getting installed, so I ran mkinitrd including them. I also uncompressed initrd.gz and tried to add them manually - I had no luck with either method. Since I am by no means a Linux expert (my background is in data and voice networking), any and all suggestions and URLs will be appreciated! Mark

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss