- Discuss - lists.centos.org

How Can I ...
by Eugene Poole 24 Mar '18

24 Mar '18

I've got a WD My Passport Ultra 1TB (USB) plugged into my router and I have 4 Windows machines, all running Windows 7, and all 4 machines can see the device as drive 'Y'. I use this device several ways, i.e. all my Windows machines use the same Firefox bookmarks and cookies I've got 5 machines running CentOS 6 x86_64 and I'd like to know what do I have to do for them to 'see' that same 1TB device? Right now I use winscp to get the data from CentOS and save it on the device via Windows. -- Eugene Poole Woodstock, Georgia

5 4

exim PAM authentication: all users unknown
by hw 22 Mar '18

22 Mar '18

Hi, how come that exim can not authenticate users using PAM? ====================== PLAIN: driver = plaintext server_set_id = $auth2 server_prompts = : server_condition = ${if pam{$auth2:$auth3}{yes}{no}} server_advertise_condition = ${if def:tls_cipher } server_debug_print = "auth: $1 $2 $3" ====================== 2969 SMTP<< AUTH PLAIN AGp2AGdsdWViaXJk 2969 PLAIN authenticator server_condition: 2969 $auth1 = 2969 $auth2 = user 2969 $auth3 = password 2969 $1 = 2969 $2 = user 2969 $3 = password 2969 auth: user password 2969 Running PAM authentication for user "user" 2969 PAM error: Authentication failure 2969 expanded string: no 2969 SMTP>> 535 Incorrect authentication data ======================== unix_chkpwd[2928]: check pass; user unknown unix_chkpwd[2928]: password check failed for user (user) exim: pam_unix(exim:auth): authentication failure; logname= uid=93 euid=93 tty= ruser= rhost= user=user ========================= It works just fine on the old server but not on the new one. I have verified that the user which is considered as unknown can log in to the console just fine, and I tried multiple users. I have found a bug report[1] which suggests that the authentication fails because exim uses its own user-ID to do the authentication. Yet the bug has probably been fixed. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=449256

1 0

CentOS-announce Digest, Vol 157, Issue 6
by centos-announce-request＠centos.org 21 Mar '18

21 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0549 Critical CentOS 6 firefox Security Update (Johnny Hughes) 2. CESA-2018:0549 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Mar 2018 16:39:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0549 Critical CentOS 6 firefox Security Update Message-ID: <20180320163922.GA16788(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0549 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0549 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 0c39e8f9ce8178d7884b572f6b09979193aa48b7911fb9761e436c3852de738c firefox-52.7.2-1.el6.centos.i686.rpm x86_64: 0c39e8f9ce8178d7884b572f6b09979193aa48b7911fb9761e436c3852de738c firefox-52.7.2-1.el6.centos.i686.rpm d08188d33bb737bf691617c9de7894b19e3550325c10aa4196710c1b32650711 firefox-52.7.2-1.el6.centos.x86_64.rpm Source: 622a18de6cf2ea184ce40fa9505b3312bb407fa35ad329cf1fa3dae25c861156 firefox-52.7.2-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 20 Mar 2018 16:40:23 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0549 Critical CentOS 7 firefox Security Update Message-ID: <20180320164023.GA16890(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0549 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0549 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 90c6836eb7f11692f50299231d26262822f79d4da6e1e1cb36e6dcc68c1dd870 firefox-52.7.2-1.el7.centos.i686.rpm 5b8934a852316df6ce2fe5488c2a4ea8d78d1d2724a50be7f73f2874494918d2 firefox-52.7.2-1.el7.centos.x86_64.rpm Source: 1a16107c6ed3d75c81ac01897c88f3c82a10faa894a74b3830ee5359ea7d86e5 firefox-52.7.2-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 6 ***********************************************

1 0

Upgrade Centos 6 to Centos 7 32 Bits i686 architecture.
by Ger van Dijck 20 Mar '18

20 Mar '18

Hi , I am running Centos 6 on an old Acer S2000 PC 1Mb memory and i686 32 bits architecture. Question : Is there a possibility to upgrade to Centos 7 32 bits ? Regards , Ger van Dijck. -- Gemaakt met Opera's e-mailprogramma: http://www.opera.com/mail/

4 3

selinux: how to allow access?
by hw 20 Mar '18

20 Mar '18

Hi, how do I allow exim access to a socket in order to be able to do local deliveries to cyrus? type=AVC msg=audit(1521179280.845:1920270): avc: denied { name_connect } for pid=319 comm="exim" dest=24 scontext=system_u:system_r:exim_t:s0 tcontext=system_u:object_r:lmtp_port_t:s0 tclass=tcp_socket Yet again I could not find any documentation explaining how to do basic things like this :( Selinux is more like a curse than anything else :( Why is there not even a good documentation?

7 10

CentOS-announce Digest, Vol 157, Issue 5
by centos-announce-request＠centos.org 20 Mar '18

20 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Announcing the release for Gluster 4.0 on CentOS Linux 7 x86_64 (Niels de Vos) 2. Announcing the release for Gluster 4.0 on CentOS Linux 6 x86_64 (Niels de Vos) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Mar 2018 20:16:50 +0100 From: Niels de Vos <ndevos(a)redhat.com> To: centos-announce(a)centos.org Subject: [CentOS-announce] Announcing the release for Gluster 4.0 on CentOS Linux 7 x86_64 Message-ID: <20180319191650.GJ2528(a)ndevos-x270.lan.nixpanic.net> Content-Type: text/plain; charset="us-ascii" I am happy to announce the General Availability of Gluster 4.0 for CentOS 7 on x86_64. These packages are following the upstream Gluster Community releases, and will receive monthly bugfix updates. Gluster 4.0 is a Short-Term-Maintenance release, and will only receive updates until the next version (4.1) becomes available. The difference between Long-Term-Maintenance and Short-Term-Maintenance releases is explained on the Gluster release schedule page: https://www.gluster.org/community/release-schedule/ Users of CentOS 7 can now simply install Gluster 4.0 with only these two commands: # yum install centos-release-gluster40 # yum install glusterfs-server The centos-release-gluster40 package is delivered via CentOS Extras repos. This contains all the metadata and dependancy information, needed to install Gluster 4.0. Note that the standard centos-release-gluster (virtual) package is still available and points to the 3.12 version. This is intentional because 3.12 is a Long-Term-Maintenance version and does not require users to update the major versions avery couple of months. Some deployments may need to install the centos-release-gluster package as well as centos-release-gluster40 to fullfill dependencies for other projects (possibly for oVirt, there may be others). We have a quickstart guide specifically built around the packages are available, it makes for a good introduction to Gluster and will help get you started in just a few simple steps, this quick start is available at https://wiki.centos.org/SpecialInterestGroup/Storage/gluster-Quickstart More details about the packages that the Gluster project provides in the Storage SIG is available in the documentation: https://wiki.centos.org/SpecialInterestGroup/Storage/Gluster The centos-release-gluster* repositories offer additional packages that enhance the usability of Gluster itself. Utilities and tools that were working with previous versions of Gluster are expected to stay working fine. If there are any proboems, or requests for additional tools and applications to be provided, just send us an email with your suggestions. The current list of packages that is (planned to become) available can be found here: https://wiki.centos.org/SpecialInterestGroup/Storage/Gluster/Ecosystem-pkgs We welcome all feedback, comments and contributions. You can get in touch with the CentOS Storage SIG on the centos-devel mailing list ( https://lists.centos.org ) and with the Gluster developer and user communities at https://www.gluster.org/mailman/listinfo , we are also available on irc at #gluster on irc.freenode.net, and on twitter at @gluster . Cheers, Niels de Vos Storage SIG member & Gluster maintainer

1 0

[LEARNING OUTCOME] Wi-Fi WPA Hacking Tool is Totally Useless on New Wireless Routers
by Turritopsis Dohrnii Teo En Ming 19 Mar '18

19 Mar '18

Hi, I am sharing my learning outcomes. Recently I downloaded Kali Linux 64-bit Version 2018.1 and ran it on my HP laptop with the integrated Intel Dual Band Wireless-AC 8260 Wireless Network Card. I wanted to test if I could hack the Wi-Fi WPA password on Ruckus R700 Access Point (AP) and the Aztech DSL8900GR(AC) Wireless Router. So I started using the Reaver WPA cracking tool. I understand that the Reaver tool works because there is a bug with Wi-Fi Protected Setup (WPS). I have no luck with Reaver on the Ruckus R700 Access Point. After running Reaver, I found out that WPS is permanently disabled on the Ruckus R700 AP with no option to turn it back on at all. Hence It is not possible to hack the WPA password on Ruckus R700 AP. Understanding that I couldn't do anything further with Ruckus R700 AP, I proceeded to test Reaver on the Aztech DSL8900GR(AC) wireless router. In this case, I also found out that WPS is disabled by default on the Aztech wireless router. Reaver will not be useful at all if WPS is disabled. But there is an option to enable WPS. So I enabled WPS in the Aztech wireless router configuration page. And continued testing with Reaver. But because Aztech wireless router has the rate limiting security feature, brute force password attacks will be very slow and probably take forever. The rate limiting security feature on the Aztech wireless router is meant to slow you down when you are brute forcing the WPS pin. So here is my conclusion: Reaver Wi-Fi WPA hacking tool is totally useless on new wireless routers which have the WPS disabled or have implemented a fix for the WPS bug. Are there any other WPA cracking tools which I can use in my educational learning journey? Please advise. Mr. Turritopsis Dohrnii Teo En Ming Singapore 13 March 2018 Tuesday 4:28 PM Singapore Time ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ [2] http://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming ===END SIGNATURE===

2 1

xfs file system errors
by Jerry Geis 18 Mar '18

18 Mar '18

How do I fix an xfs file system error ? I searched and it says to run xfs_repair /dev/sda1 - did not work. I got an error on boot and the machine dropped into service mode by entering the PW. I entered the above command and it said couldnt load library... SO I rebooted, dropped into rescue mode. Again I entered the command above and it said teh same thing.something about could not load library What am I missing ? Thanks, Jerry

4 3

cyrus: socket options
by hw 17 Mar '18

17 Mar '18

Hi, what are the following messages supposed to tell me and does this indicate a problem? # systemctl status cyrus-imapd [...] master[3766]: unable to setsocketopt(IP_TOS): Operation not supported master[3766]: unable to setsocketopt(IP_TOS): Operation not supported [...] Exim says it can not connect to the lmtp socket even when selinux doesn´t get in the way. The configuration looks like this: cyrus.conf (none of the two options work): [...] # lmtp cmd="lmtpd -a" listen="lmtp:127.0.0.1" prefork=4 lmtpunix cmd="lmtpd -a" listen="/var/lib/imap/socket/lmtp" prefork=4 [...] exim.conf: [...] begin transports # cyrus_ltcp: # driver = smtp # protocol = lmtp # delivery_date_add # envelope_to_add # return_path_add # hosts = localhost # allow_localhost lmtp_socket: driver = lmtp socket = /var/lib/imap/socket/lmtp delivery_date_add envelope_to_add return_path_add # ls -la /var/lib/imap/socket/lmtp srwxrwxrwx. 1 root root 0 Mar 16 12:58 /var/lib/imap/socket/lmtp I have this working on the old server (which doesn´t run Centos) and am trying to migrate it to the new one (which runs Centos 7.4). The version of cyrus and sasl are the same on both machines. What´s the problem with Centos that these things don´t just work as they usually do?

2 4

spectre variant 2
by Fred Smith 17 Mar '18

17 Mar '18

Hi all! I'm running an up-to-date Centos-7 on an AMD Vishera 6300, 6 core CPU. I note that when I run the redhat script to test for spectre & meltdown I get this result for variant 2: Variant #2 (Spectre): Vulnerable CVE-2017-5715 - speculative execution branch target injection - Kernel with mitigation patches: OK - HW support / updated microcode: NO - IBRS: Not disabled on kernel commandline - IBPB: Not disabled on kernel commandline and when I run the one from github I get this: CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigated according to the /sys interface: NO (kernel confirms your system is vulnerable) * Mitigation 1 * Kernel is compiled with IBRS/IBPB support: YES * Currently enabled features * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * IBPB enabled: NO * Mitigation 2 * Kernel compiled with retpoline option: YES * Kernel compiled with a retpoline-aware compiler: UNKNOWN > STATUS: VULNERABLE (Vulnerable: Retpoline without IBPB) So, I"m wondering: 1. has RH in fact released mitigations for this issue for AMD processors, and 2. has AMD released microcode updates for this? I have no idea how to query AMD with such a question, anybody here know? Thanks in advance! -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- The eyes of the Lord are everywhere, keeping watch on the wicked and the good. ----------------------------- Proverbs 15:3 (niv) -----------------------------

2 2

CentOS-announce Digest, Vol 157, Issue 4
by centos-announce-request＠centos.org 16 Mar '18

16 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0526 Critical CentOS 6 firefox Security Update (Johnny Hughes) 2. CESA-2018:0527 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 15 Mar 2018 18:59:48 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0526 Critical CentOS 6 firefox Security Update Message-ID: <20180315185948.GA44704(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0526 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0526 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 29059b6e8c894eef2944154ad9c3e5e98178bd2903a918ab1ab3b35098e1faf3 firefox-52.7.0-1.el6.centos.i686.rpm x86_64: 29059b6e8c894eef2944154ad9c3e5e98178bd2903a918ab1ab3b35098e1faf3 firefox-52.7.0-1.el6.centos.i686.rpm 5ab36e9cf3534cc1af6c6ee3d6e302907235e8f8dd2b00f8003ea2e3ef98d272 firefox-52.7.0-1.el6.centos.x86_64.rpm Source: ae98346dd0287b8d7fe36edd4692a1980f4fcf1d53e7633307e33e67adfe9a71 firefox-52.7.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 15 Mar 2018 19:24:33 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0527 Critical CentOS 7 firefox Security Update Message-ID: <20180315192433.GA58165(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0527 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0527 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3d4f163b3fe61aa41272b201f56732c9352c1e12d13e85dc15f466363d0ba59b firefox-52.7.0-1.el7.centos.i686.rpm 9546d6326537d96a09245d90386164fd8786578b2c5de142e3f877c532e85612 firefox-52.7.0-1.el7.centos.x86_64.rpm Source: 0852393b938ea86a3af795b46909d5fc13cf9da3f9f9b6ff85c8b2c2ee2f3e17 firefox-52.7.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 4 ***********************************************

1 0

VirtualBox on CentOS 7 with bridged network not working
by James Pearson 16 Mar '18

16 Mar '18

I've installed VirtualBox v5.2 on a CentOS 7.4 machine, but VMs set up with bridged networking can not 'see' past the VirtualBox host machine i.e. the VM can ping the host and vice versa, but the VM can not ping anything else and other machines on the same subnet can't ping the VM There are no firewall rules configured on the 7.4 host and selinux is disabled I have a similar set up on a CentOS 6.9 host, where everything works as expected Googling doesn't show up any similar issues, so I guess I'm missing something on the host machine Does anyone have any idea what could be the issue? Thanks James Pearson

3 3

ISCSI target + LVM Problem
by marcos sr 15 Mar '18

15 Mar '18

Hello, I have a LVM with 2 ISCSI disk mounted. The partition started presents problem such " i/o error". I unmounted the device, and restarted target server in scsi, wich as having some problems. After that i mapped iscsi and trying to mount partition again but: When i run the pvdisplay i get the following erro: read failed after 0 of 4096 at 0: Input/output error And cannot mount partition.

2 4

Squid + SquidGuard : static block page not working
by Nicolas Kovacs 15 Mar '18

15 Mar '18

Hi, I've been working with Squid + SquidGuard for a few years, though only on Slackware. I'm currently transferring my proxy expertise to CentOS 7, and right now I'm having a little problem with that. Squid works perfectly so far as a transparent HTTP + HTTPS cache proxy. The next step is to add SquidGuard, so I installed it and edited the most basic /etc/squid/squidGuard.conf file possible. In this setup, my workstation (192.168.2.2) is allowed to access anything on the Web, and all other client machines on the networks are blocked and should be redirected to the avertissement.html block page for every request. --8<------------------------------------------------------------------ # /etc/squid/squidGuard.conf dbhome /var/squidGuard logdir /var/log/squidGuard src admin { ip 192.168.2.2 } acl { admin { pass any } default { pass none redirect http://nestor.microlinux.lan/avertissement.html } } --8<------------------------------------------------------------------ I appended the following lines to /etc/squid/squid.conf: --8<------------------------------------------------------------------ # SquidGuard url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf url_rewrite_children 5 --8<------------------------------------------------------------------ Now this setup sort of works. My workstation can access anything, other clients are blocked. Unfortunately, the block page avertissement.html is not displayed. Instead, I get a Squid error page: The following error was encountered while trying to retrieve the URL: https://http/* Unable to determine IP address from host name "http". Any idea why my static block page avertissement.html is not displayed? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 4

Good work, Red Hat!
by isdtor 15 Mar '18

15 Mar '18

Delivered as per https://access.redhat.com/articles/3311301. This is good news. Backporting those updates across three gcc versions does not look like the easiest exercise to me. $ rpm -qp --changelog gcc-4.4.7-18.el6_9.2.x86_64.rpm |head -n 6 * Wed Jan 31 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.2 - Fix indirect_jump/tablejump patters for retpolines (#1535656) * Tue Jan 23 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.1 - Retpoline support (#1535656) $ rpm -qp --changelog kernel-2.6.32-696.23.1.el6.x86_64.rpm ... * Sat Feb 10 2018 Jan Stancek <jstancek(a)redhat.com> [2.6.32-696.23.1.el6] - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455] - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645] - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645] ...

1 0

CentOS 6 i386 - meltdown and spectre
by Peter Wood 13 Mar '18

13 Mar '18

I have a clean install, fully updated CentOS 6 32-bit. When I run the Red Hat detection script: https://access.redhat.com/sites/default/files/spectre-meltdown--a79614b.sh it finds that the system is vulnerable. Is this false positive or there is no patches for CentOS 6 32-bit systems? Thank you, -- Peter

4 7

Squid vs. iptables redirection: exception for certain domains ?
by Nicolas Kovacs 12 Mar '18

12 Mar '18

Hi, I'm currently facing a quite tricky problem. Here goes. I have setup Squid as a transparent HTTP+HTTPS proxy in my local network. All web traffic gets handed over to Squid by an iptables script on the server. Here's the relevant section in /etc/squid/squid.conf: --8<------------------------------------------------------------- # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/amandine.sandbox.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB --8<------------------------------------------------------------- And here's the corresponding section of my firewall script: --8<------------------------------------------------------------- # Commandes IPT=/usr/sbin/iptables SYS=/usr/sbin/sysctl SERVICE=/usr/sbin/service # Internet IFACE_INET=enp2s0 # Réseau local IFACE_LAN=virbr0 IFACE_LAN_IP=192.168.2.0/24 # Serveur SERVER_IP=192.168.2.1 ... # Squid $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 80 -j REDIRECT --to-port 3128 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 443 -j REDIRECT --to-port 3129 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3130 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3130 -j ACCEPT --8<------------------------------------------------------------- This setup works nicely for the vast majority of web sites. BUT: a handful of sites has some trouble with my local certificate. For example, I can't sync my local Github repo anymore. Or my local OwnCloud client spews back a warning message on every startup. I asked on the Squid mailing list if there was a possibility to create an exception for a list of domains, so that these can simply bypass the proxy. The problem is, according to one of the developers, I have to tackle that problem earlier in the process, e. g. in the firewall setup. So here's what I want to do, in plain words: 1. Redirect all HTTP traffic (port 80) to port 3128. So far so good. 2. Redirect all HTTPS traffic (port 443) to port 3129. Equally OK. AND... 3. DO NOT REDIRECT traffic that goes to certain domains, like: github.com credit-cooperatif.coop cloud.microlinux.fr squid-cache.org etc. Ideally, these domains should be read from a simple text file. Any idea how I could do that? I don't even know if this is theoretically possible. Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

4 6

SELinux breaks Squid's ssl_crtd helper
by Nicolas Kovacs 10 Mar '18

10 Mar '18

Hi, I've setup a transparent HTTP+HTTPS proxy on my server running CentOS 7, using Squid. Here's my configuration file. --8<---------------------------------------------------------------- # /etc/squid/squid.conf # Définitions acl localnet src 192.168.2.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Règles d'accès http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/nestor.microlinux.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # Emplacement de ssl_crtd et du cache des certificats TLS sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 # SSL-Bump acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all # Taille du cache dans la RAM cache_mem 2048 MB # Emplacement et taille du cache sur le disque # cache_dir ufs /var/spool/squid 100 16 256 # Vidage système coredump_dir /var/spool/squid # Durée de vie des fichiers sans date d'expiration refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 --8<---------------------------------------------------------------- First, I tested the configuration in permissive mode, where it works perfectly. After running it a while, I get the following SELinux alert. # sealert -a /var/log/audit/audit.log ***** Plugin catchall (17.1 confidence) suggests ***** If you believe that ssl_crtd should be allowed read access on the index.txt file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ssl_crtd' --raw | audit2allow -M my-sslcrtd # semodule -i my-sslcrtd.pp Unfortunately the suggested solution doesn't work, because the problem reappears, and I get all sorts of errors in /var/log/squid/cache.log, all due to ssl_crtd not being able to access stuff under /var/lib/ssl_db. Any idea how I can solve this problem permanently ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 3

kpartx can not detach
by Leon Fauster 10 Mar '18

10 Mar '18

OS: EL6 - sometimes I use kpartx -a /mnt/.../lvdisk.img to map the partitions and mount them via /dev/mapper/loop0pX After using the disk (unmounting it) I noticed that detaching such mapping via kpartx -d does not result in freeing up the loop devices. Results: System reboots shows that the filesystem where lvdisk.img is located can't be unmounted. lsof, fuser, ps does not show any usage. Even removing the device node via dmsetup remove /dev/mapper/loop0pX does not help. Trying to unmount the underlying filesystem still shows /mnt: device is busy. Any other suggestions would be greatly appreciated! -- Thanks LF

2 2

yum list "available" versus "updates", and centosplus versioning
by Robert P. J. Day 10 Mar '18

10 Mar '18

quite possibly more a yum question than a centos question, but i'm a bit confused about the difference between listing "available" packages versus "updates" packages. short example -- listing what the yum man page suggests should be "available" for installation, restricting myself to centosplus: $ yum list available --disablerepo=\* --enablerepo=centosplus ... snip ... Available Packages kernel-plus.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-abi-whitelists.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-doc.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-headers.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ first, i always thought "yum list available" would list only packages that i did not *already* have installed, and if i wanted to list installed packages eligible for update, i would run: $ yum list updates --disablerepo=\* --enablerepo=centosplus Updated Packages postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ as you can see, the alleged updates are also listed as "available" from the first command -- has it always been this way? if so, i guess i just never noticed. (is there a way to list *only* available, uninstalled packages with some sort of filter?) more curiously, some of the available packages from the centosplus repo have a package version that says merely "centos", not "centos.plus": postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus ^^^^^^ is that deliberate? it would seem to have the potential for confusion if one searches later for packages based on that string. finally, the alleged update for python-perf: python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus would seem to match *exactly* the currently installed numeric version on my system: $ rpm -q python-perf python-perf-3.10.0-693.17.1.el7.x86_64 $ that is, both seem to be "3.10.0-693.17.1.el7", so how would this constitute an available "update"? perhaps there's something fundamental about version numbering and the centosplus repo i'm missing here. rday

1 0

Upcoming Dojos: Bangalore, Singapore
by Rich Bowen 09 Mar '18

09 Mar '18

I want to draw attention to two upcoming events. First, we have the CentOS Bangalore Dojo. Details are still emerging, but it will be held on March 21 at the Red Hat India office. Details are https://www.meetup.com/CentOS-India/events/248566854/ and more details will be coming very soon. Then, on the following Sunday, March 25th, we'll be holding another Dojo as part of the FOSSAsia event in Singapore, at the Lifelong Learning Institute. The schedule for that event is almost complete, and further details are available here: https://wiki.centos.org/Events/Dojo/Singapore2018 Other tentative upcoming events are listed at https://wiki.centos.org/Events If you are holding any CentOS events - or if you would like to - please get in touch with the centos-promo mailing list (or me directly, if you prefer) for assistance in producing and/or promoting those events. -- Rich Bowen - rbowen(a)redhat.com @RDOcommunity // @CentOSProject // @rbowen

1 0

Re: [CentOS] FW: Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 09 Mar '18

09 Mar '18

Le 09/03/2018 à 12:01, Patton, Eamonn J a écrit : > Just to let you know that our Office365 safelinks analyser is > categorising the link given below (regarding Squid with SquidAnalyzer > "blog.microlinux.fr") as "malicious". That usually means they have > detected (or think they have detected) some malware on the site. Thanks for reporting this. Though I bluntly admit I just ignore everything coming from Microsoft. Hotmail has been tagging my company's mailserver as a spammer for ages, so I'm tagging everything coming from Microsoft as crapware. Nothing good has ever been produced by this company. The last time I actually used MS Windows for work was around 2001, before Windows XP came out. This is the year I moved to Linux (Slackware 7.1 at the time), and I've been 100 % GNU/Linux ever since. :o) Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 2

Issues with Mirror Sites
by Kenneth Sutherland 09 Mar '18

09 Mar '18

Hi, Newbie question, is there a problem with the Centos 7 mirror sites, no matter what I do the mirror sites are reporting back the meta data in the repodata folder is wrong and I cant do a Yum Update? when I browse to a few of the mirror sites it looks to me that they sym links are broken? I apologies in advance if I got this completely wrong as am still learning Cheers in advance Ken

1 0

mate-terminal crash when using drag-n-drop tabs
by James Pearson 09 Mar '18

09 Mar '18

We're using mate-terminal (1.16.3) from EPEL on CentOS 7.4 with the Mate desktop, but mate-terminal crashes when we do the following: Start mate-terminal, open a tab (File -> Open Tab) then with the left mouse button drag a tab and drop it in the same terminal window - and the terminal window crashes ... I did a bit of Googling, and found this issue reported in earlier releases of mate-terminal - which was fixed - but no mention of issues with 1.16.x However, if I rebuild and install the package from the mate-terminal 1.16.3 SRPM from EPEL, it doesn't crash ... Which is rather bizarre Just wondering if anyone else has seen this problem and/or could explain what might be causing the issue with the binary from EPEL ? Thanks James Pearson

1 1

Memory Leak with PHP
by Alain Jean-Mairet 09 Mar '18

09 Mar '18

I understand that this problem may have very little to do with CentOs, but it happens to occur on a CentOS webserver and maybe you’ll have a clue. Since a few months, after many upgrades on several blogs (now running with PHP7), our server is eating up RAM no end. PHP processes swell to over 2 GB (each) and when the whole RAM and the whole swap are full, problems stack up and finally paralyze the system. This despite having “memory_limit = 512M" in all php.ini (there are several PHP versions on the system, selection is made via .htaccess). CenOS 6.9 on a Xeon 8 cores with now 64 GB RAM. This is a snip of a top this morning, just 2 days after the latest reboot: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 31163 apache 20 0 939m 690m 8876 S 51.5 1.1 102:16.90 php-fpm 29603 apache 20 0 1208m 961m 10m S 33.7 1.5 136:54.95 php-fpm 11858 apache 20 0 1660m 1.4g 9564 R 31.3 2.2 190:41.25 php-fpm 31207 apache 20 0 916m 668m 9636 R 18.1 1.0 101:38.72 php-fpm 31218 apache 20 0 930m 682m 9264 S 16.8 1.1 101:55.51 php-fpm 2873 apache 20 0 1694m 1.4g 9972 S 11.2 2.2 194:42.82 php-fpm 2854 apache 20 0 1657m 1.4g 10m S 9.9 2.2 191:15.43 php-fpm 2326 mysql 20 0 4993m 1.3g 6076 S 7.3 2.0 149:11.06 mysqld 2842 apache 20 0 1664m 1.4g 8996 S 4.9 2.2 191:34.00 php-fpm 17085 apache 20 0 1454m 1.2g 9824 S 1.3 1.9 167:25.43 php-fpm 13850 apache 20 0 464m 45m 5872 S 1.0 0.1 0:43.55 httpd 20044 root 20 0 15276 1496 952 R 1.0 0.0 15:05.99 top 1936 apache 20 0 1684m 1.4g 10m S 0.7 2.2 192:37.37 php-fpm 19109 apache 20 0 463m 44m 5808 S 0.7 0.1 0:18.66 httpd 24782 apache 20 0 465m 46m 5720 S 0.7 0.1 0:12.01 httpd 1848 apache 20 0 1579m 1.3g 10m S 0.3 2.1 183:02.13 php-fpm 2718 root 20 0 1074m 12m 2536 S 0.3 0.0 7:32.85 fail2ban-server 15221 apache 20 0 475m 49m 9508 S 0.3 0.1 0:22.24 httpd 16764 apache 20 0 476m 49m 9456 S 0.3 0.1 0:21.82 httpd 17757 apache 20 0 461m 42m 5784 S 0.3 0.1 0:18.26 httpd 19108 apache 20 0 463m 44m 5848 S 0.3 0.1 0:20.80 httpd 19155 apache 20 0 463m 44m 5756 S 0.3 0.1 0:17.15 httpd 24791 apache 20 0 462m 43m 5764 S 0.3 0.1 0:14.87 httpd 24794 apache 20 0 464m 45m 5780 S 0.3 0.1 0:15.07 httpd 29668 apache 20 0 459m 40m 5888 S 0.3 0.1 0:34.05 httpd 29794 apache 20 0 463m 44m 5868 S 0.3 0.1 0:35.23 httpd 31184 apache 20 0 936m 688m 9572 S 0.3 1.1 103:33.80 php-fpm 31212 apache 20 0 908m 660m 9860 S 0.3 1.0 101:27.74 php-fpm Any idea, suggestion would be greatly appreciated! --

1 0

RADIUS
by hw 09 Mar '18

09 Mar '18

Hi, I´m trying to figure out how to practically use RADIUS to authenticate users. So far, I have only found documentation explaining that the idea is that users somehow magically need to authenticate against a RADIUS server via a device like a switch or a wireless access point before they are given or being denied access to a network. I understand that I have to refer to the documentation of the switch or access point to figure out how to set up RADIUS authentication with the particular device. But how is this achieved in practice? Let´s say I have a couple laptops and a couple phones and a couple computers which connect either to a switch or to a wireless access point. Both the switch and the access point support RADIUS, and I would set them up to talk to the RADIUS server and require every device that wants to connect to the network through them to authenticate first. I also have a couple thin clients and a couple computers which use PXE-boot, and the users of those would have to provide authentication before the machines could even boot. Then what? How do I make it so that the users are actually able to authenticate? Is there any documentation about this? Or am I not supposed to use RADIUS but something else?

10 55

Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 08 Mar '18

08 Mar '18

Hi, I've been running Squid successfully on CentOS 7 (and before that on 6 and 5), and it's always been running nicely. I've been using it mostly as a transparent proxy filter in school networks. So far, I've only been able to filter HTTP. Do any of you do transparent HTTPS filtering ? Any suggestions, advice, caveats, do's and don'ts ? Cheers from the snowy South of France, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

13 32

NIC naming conventions and vmware
by John Ratliff 07 Mar '18

07 Mar '18

I have a couple of CentOS 7 machines running in a vmware environment. On all the older ones I've deployed, the NIC is named ens160, but on all of the new ones, it is named ens192. I can't find any difference in the hardware that would account for this. Any suggestions on what I can do to figure out why some are named ens160 and some ens192? Thanks.

4 3

An selinux issue
by m.roth＠5-cent.us 07 Mar '18

07 Mar '18

CentUS 7.4 >From sealert: SELinux is preventing /usr/sbin/sshd from read access on the file /etc/ssh/moduli. ***** Plugin restorecon (94.8 confidence) suggests ************************ If you want to fix the label. /etc/ssh/moduli default label should be etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/ssh/moduli <...> Additional Information: Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023 Target Context system_u:object_r:unlabeled_t:s0 Target Objects /etc/ssh/moduli [ file ] Source sshd Source Path /usr/sbin/sshd --------- Except: ls -laFZ /etc/ssh/moduli -rw-r--r--. root root system:object_r:etc_t:s0 /etc/ssh/moduli ls -laFZ /usr/sbin/sshd -rwxr-xr-x. root root system_u:object_r:sshd_exec_t:s0 /usr/sbin/sshd* And I even restarted sshd. So, what's selinux seeing that I'm not? mark

1 0

latest skype (version 8.16.0.4) on Centos 7
by Fred Smith 07 Mar '18

07 Mar '18

Hi all! I've finally been reduced to having to install Skype on my Linux box. I resisted for years, but now ended up trying it. and while the latest RPM installs just fine, it refuses to acknowledge that I have a microphone! In fact I have two: 1 in the USB web cam (it finds the cam), the second in a Plantronics USB headset, which works fine but not with skype. it is as if it doesn't exist. So, when I connect to someone I can hear them, see them, and they can see me, but I'm producing no sound output. All the web hits I can find for nonfunctional microphone on the web are for Ubuntu. GAH! running ldd against the skypeforlinux binary results in a huge list of shared libraries, including libasound (which is what the ubuntu messages say is missing). Anybody got a clue? Thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "For him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy--to the only God our Savior be glory, majesty, power and authority, through Jesus Christ our Lord, before all ages, now and forevermore! Amen." ----------------------------- Jude 1:24,25 (niv) -----------------------------

6 9

evince
by Chris Olson 06 Mar '18

06 Mar '18

We have some small networks with connectivity to the Internet through firewall routers. The smallest has one Windows 7 system and three Linux systems including both CentOS 6 and CentOS 7 machines. The Windows 7 systems have full Adobe packages that are updated regularly and are trouble free. On the Linux systems, evince has been our go to product for viewing and printing .pdf documents. This has worked well for at least four years. Some .pdf documents received recently from insurance companies and financial institutions appear to have a font problem that we have not been able to solve. Information available at the sites listed below have been no help. Previous font problems with various warnings have been solved automatically with substitution, but this does not seem to be working with these new files. The current problem leaves blank nearly half of the pages in some documents. Is there better source to look for answers than these two: http://www.gnome.org/projects/evince/ https://wiki.gnome.org/Apps/Evince Any help with this issue would be greatly appreciated. Thanks. [user@computer ~]$ uname -a Linux delle520 2.6.32-696.20.1.el6.x86_64 #1 SMP Fri Jan 26 17:51:45 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux [user@computer]$ evince Plan.pdf Error: could not create type1 face some font thing failed Error: could not create type1 face some font thing failed o o o o

6 6

Addind kmail to EPEL
by Yves Bellefeuille 05 Mar '18

05 Mar '18

I finally decided to move from CentOS 6 to CentOS 7, but was surprised to see that kmail is no longer included: Red Hat deliberately decided to omit it. How can I ask that kmail be added to EPEL? The information on EPEL's site basically says to submit it myself, but that's above my capabilities. -- Yves Bellefeuille <yan(a)storm.ca>

3 2

sqlinux weirdness
by Fred Smith 04 Mar '18

04 Mar '18

Every now and then I get an alert like this one. I have no clue what this "rear" subsystem is, or why madam would be trying to write to its log file. Can anyone enlighten me? thanks in advance! ------------------------- SELinux is preventing /usr/sbin/mdadm from write access on the file /var/log/rear/rear-fcshome.log.lockless. ***** Plugin restorecon (93.9 confidence) suggests ************************ If you want to fix the label. /var/log/rear/rear-fcshome.log.lockless default label should be var_log_t. Then you can run restorecon. Do # /sbin/restorecon -v /var/log/rear/rear-fcshome.log.lockless ***** Plugin leaks (6.10 confidence) suggests ***************************** If you want to ignore mdadm trying to write access the rear-fcshome.log.lockless file, because you believe it should not need this access. Then you should report this as a bug. You can generate a local policy module to dontaudit this access. Do # ausearch -x /usr/sbin/mdadm --raw | audit2allow -D -M my-mdadm # semodule -i my-mdadm.pp ***** Plugin catchall (1.43 confidence) suggests ************************** If you believe that mdadm should be allowed write access on the rear-fcshome.log.lockless file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'mdadm' --raw | audit2allow -M my-mdadm # semodule -i my-mdadm.pp Additional Information: Source Context system_u:system_r:mdadm_t:s0-s0:c0.c1023 Target Context system_u:object_r:cron_log_t:s0 Target Objects /var/log/rear/rear-fcshome.log.lockless [ file ] Source mdadm Source Path /usr/sbin/mdadm Port <Unknown> Host fcshome.stoneham.ma.us Source RPM Packages mdadm-4.0-5.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name fcshome.stoneham.ma.us Platform Linux fcshome.stoneham.ma.us 3.10.0-693.17.1.el7.x86_64 #1 SMP Thu Jan 25 20:13:58 UTC 2018 x86_64 x86_64 Alert Count 2550 First Seen 2016-12-13 01:30:06 EST Last Seen 2018-03-03 01:30:07 EST Local ID ce9a5be1-55a8-4ad2-bdd9-eefcb5fc7c5b Raw Audit Messages type=AVC msg=audit(1520058607.285:46041): avc: denied { write } for pid=17471 comm="mdadm" path="/var/log/rear/rear-fcshome.log.lockless" dev="md126" ino=1368832 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cron_log_t:s0 tclass=file -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- God made him who had no sin to be sin for us, so that in him we might become the righteousness of God." --------------------------- Corinthians 5:21 ---------------------------------

3 3

Web site not responding with Firefox 52.6.0 (64-bit)
by dsavage＠peaknet.net 04 Mar '18

04 Mar '18

I don't know if this is a CentOS7/Firefox problem or one with the distant web site slashdot.org. I can connect to it just fine with the latest Firefox on my Windows 10 desktop PC, but not with Firefox 52.6.0 on this CentOS 7.4 laptop. This has been an on-going problem for several weeks. Google search results are sketchy. slashdot.org may have been a DDOS target today, but as I write this network monitors say it's up and running. RC4 deprecation may be a factor, but I doubt it. I can traceroute to the site just fine, and its URL resolves with no trouble. The error message I'm getting is "The connection has timed out" The URL I've used forever is: https://slashdot.org/index2.pl?fhfilter=journal&source=autorefresh&nobeta=1 I'm stumped. Does this sound familiar to anyone in CentOS land? --Doc Savage Fairview Heights, IL

4 3

why does "rescue" mode bring me to runlevel 5 (multi-user target)?
by Robert P. J. Day 02 Mar '18

02 Mar '18

finishing a week of teaching a comptia linux+ class off of centos 7.4 and wanted to demo how to boot to "rescue" mode, so i rebooted, selected "rescue" mode at grub menu, which still booted to full multiuser, graphical mode. what am i doing wrong? or is this a dumb question? rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

2 2

Going back to a minimal system : strange problem
by Nicolas Kovacs 02 Mar '18

02 Mar '18

Hi, Some time ago I wrote a little script elaguer.sh ("élaguer" means "to prune") which simply removes all packages that are *not* part of a minimal installation. First I created a list of packages that make up a minimal CentOS installation. On a fresh install, I would do something like this: # rpm -qa --queryformat '%{NAME}\n' | sort > minimal.txt Here's the resulting list of packages. I added a comment on top: https://github.com/kikinovak/centos-7-server-lan/blob/master/config/pkglist… And here's the script to prune the installation, e. g. remove everything that's not on the list. https://github.com/kikinovak/centos-7-server-lan/blob/master/elaguer.sh This script worked perfectly for some time. But now it seems like something has changed somewhere under the hood. Because when I run it now, the script fails at the final package removal stage. One curious detail: it seems like it tries now to remove 'yum' and 'systemd', so 'yum' exits with an error. But it didn't do that before, so my guess is either 'yum' behaves differently now, or package dependencies are calculated differently. Anyway, I'm a bit clueless here. Any suggestions? Cheers from the freezing South of France, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 4

Mirror Problem
by Günther J. Niederwimmer 01 Mar '18

01 Mar '18

Hello, I have thousands of this messages on my servers ?? Is this a Problem on my site or is the infrastructure broken?? /etc/cron.hourly/0yum-hourly.cron: Could not get metalink https://mirrors.fedoraproject.org/metalink? repo=epel-7&arch=x86_64 error was 14: HTTPS Error 503 - Service Unavailable Thanks for a answer, -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

4 4

pid_max
by Jerry Geis 01 Mar '18

01 Mar '18

I have two systems both running CentOS 7.4 one shows pid_max as 32768 the other shows pid_max as 49152 Why might that be ? I would have thought they would be the same. I have not changed them. Thanks, Jerry

3 3

CentOS-announce Digest, Vol 157, Issue 1
by centos-announce-request＠centos.org 01 Mar '18

01 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0349 Important CentOS 6 java-1.7.0-openjdk Security Update (Johnny Hughes) 2. CESA-2018:0349 Important CentOS 7 java-1.7.0-openjdk Security Update (Johnny Hughes) 3. CESA-2018:0350 Important CentOS 7 gcab Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 28 Feb 2018 11:23:40 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0349 Important CentOS 6 java-1.7.0-openjdk Security Update Message-ID: <20180228112340.GA58274(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0349 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0349 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 25621bf1dabaf8d41c99d1442ce2cd88eb00635ac1197bc5d4af967edb640911 java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.i686.rpm fd90cfe03e59ba60e0f7839ecab2320c49fc6279ea484c71a430d930c907e29a java-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el6_9.i686.rpm b06939f1a4c10e735464804d50f0cb41a1b33a3f1f23652bbcfc730c3e841a17 java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el6_9.i686.rpm 8b1c571ceafaa9ef20510f0aed1b6986e5e138f9c61650c380678df7479759bb java-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el6_9.noarch.rpm 0af4d015904759c1baa612ec873ff249ce01114c770961f7cb1663b7923acba1 java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el6_9.i686.rpm x86_64: a2fbc3409ece060461e3078e6c89574130ef5b3c61296619a1f92f22938116e2 java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm 5f9392cda539d562e03fd78928fc13e08dc7800ebbbdeefd6f10ca0f5afadffe java-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm a37bab5c919e367a443d66a67959aad210f2819b7e5a16fb349b462d7347129c java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm 8b1c571ceafaa9ef20510f0aed1b6986e5e138f9c61650c380678df7479759bb java-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el6_9.noarch.rpm 6fc3136630f186350a4d77543fa62048dee2da8702cbd4dad8b840d844113663 java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm Source: fdf94e5cfc95f0556f3e1171ad8a2d1dc462d84ed4c611786ff058e2fe1189cb java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Wed, 28 Feb 2018 11:24:45 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0349 Important CentOS 7 java-1.7.0-openjdk Security Update Message-ID: <20180228112445.GA58396(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0349 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0349 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 6f912645f951cbaa4bdecf0e8ebf94989d449347354b523cf564cc1878f4cf6d java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 9cf6333d77597fa9105ffd9dfbda0834d1559d5c8ea96b2c534d52e351ccb22d java-1.7.0-openjdk-accessibility-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 3488e88d268a606ff504c7fce522979574840a4bc3622329d0f1937cf25809a0 java-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm db2bacd8b44684ed3ec345312a5735a30cb43522e685b6b50b7952949242b9ae java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 682a3b811be97f896cc96cacb8a0305bc36a144579868fa7db8f3b80447a319e java-1.7.0-openjdk-headless-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 261e18e5fe67c742c69eefcdd60172d866aafd2c36e31dfe12afffdd464f22be java-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el7_4.noarch.rpm 0b80b903b2e1dda0bb1b19f5bab3f5ea56fb3ab0418004ffbc05d0169ac55677 java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm Source: 0638716bc311fcd8b41c25eb918957d9bcc8d8d90bbff6becfbad8e12a2f2805 java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el7_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Wed, 28 Feb 2018 11:25:25 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0350 Important CentOS 7 gcab Security Update Message-ID: <20180228112525.GA58469(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0350 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0350 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: f172ac9bbbbc30f74002bfd179ca8c5e3bafdfd3932446c8f7029b1524bcf1d4 gcab-0.7-4.el7_4.x86_64.rpm 14dd5e016d3a137a398061627c36c9d39e5b48e1e90cb69ac8055bcd3b9eeeac libgcab1-0.7-4.el7_4.i686.rpm 57a7bcffe10f0f231769d7d95185c4ae9960512874b72a08616ad31943581504 libgcab1-0.7-4.el7_4.x86_64.rpm 954395631dcba4a37c80feec8cd6357ca04863ff1ae4d64f14023c64072b4d87 libgcab1-devel-0.7-4.el7_4.i686.rpm fec5a948fdae12f5a0c62bc54fde879be283e1605462e7ba834ad863ca78ee2c libgcab1-devel-0.7-4.el7_4.x86_64.rpm Source: 25fd25e04b094da2fb0bd53595f11902fcc9c784ba9d470ac7c6281fb1f8cbc0 gcab-0.7-4.el7_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 1 ***********************************************

1 0

Best practices to manager multiples sysadmins working as root with multiple servers?
by marcos sr 28 Feb '18

28 Feb '18

Hello In my new company they have a lot of CentOS linux servers. I was wondering what is the best practice do manage access root to a multiples sysadmin in multiple servers. Pupper? Ldap? Proxy Server with ssh? Thanks for attention.

2 1

Any alternatives for the horrible reposync
by Dennis Jacobfeuerborn 28 Feb '18

28 Feb '18

Hi, I'm currently trying to mirror a couple of yum repositories and the only tool that seems to be available for this is reposync. Unfortunately reposync for some inexplicable reason seems to use the yum config of the local system as a basis for its work which makes no sense and creates all kinds of problems where cache directories and metadata gets mixed up. Are there any alternatives? Some repos support rsync but not all of them so I'm looking for something that works for all repos. Regards, Dennis

5 6

Ubiquiti Model UAP-AC-PRO
by Gregory P. Ennis 27 Feb '18

27 Feb '18

Everyone, Have any of you installed ubiguiti wireless routers on your network? It looks like the setup requires the use of software; they have some packages that are ready made for Ubuntu and Debian, but not RedHat https://www.ubnt.com/download/unifi/unifi-ap-ac-pro Have any of you tried or succeeded in installation this on Centos 7.4? Greg Ennis

9 15

How to update modules in iniramfs fastly
by wuzhouhui 27 Feb '18

27 Feb '18

I know dracut can update modules in initramfs, but I think it is too slow. So I'm wondering what is the fastest way to update modules in initramfs of CentOS 7? Thanks!

4 6

Cloud image_index: is 1801-01 a release?
by Nicholas Timkovich 26 Feb '18

26 Feb '18

I load CentOS cloud images into our infrastructure for our users to use, and I have a script that looks at https://cloud.centos.org/centos/7/images/image-index, picking what has the highest revision, to find the new hotness. Up until the most recent image, they've all appeared in there; is this changing going forward? How can I automatically find the newest one and its revision tag? The untagged "latest" ones (linked to by the https://wiki.centos.org/Download page) don't appear in the sha256sums file, so I couldn't even compare sums. Can I petition for keeping the cloud image-index up-to-date? -- Nick Timkovich | Software Engineer | Computation Institute, University of Chicago | npt(a)uchicago.edu

1 0

lensfun-update-data on CentOS 7
by wwp 26 Feb '18

26 Feb '18

Hello there, did anybody have lensfun-update-data (*) to work on CentOS 7? Here I get, as root: $ lensfun-update-data Traceback (most recent call last): File "/bin/lensfun-update-data", line 118, in <module> read_location("http://lensfun.sourceforge.net/db/") File "/bin/lensfun-update-data", line 99, in read_location print("Reading {} \u2026".format(base_url + "versions.json")) UnicodeEncodeError: 'ascii' codec can't encode character '\u2026' in position 56: ordinal not in range(128) (*) 0.3.1 from EPEL. Regards, -- wwp

1 0

Re-enable grub boot in UEFI (Windows took over it)
by wwp 26 Feb '18

26 Feb '18

Hello there, Dell XPS-15-9560 laptop (SSD drive, UEFI, secure boot off).. Windows 10 pre-installed, CentOS7 installed in a separate partition and running for months w/o issue. Don't know what happened but at reboot yesterday (not even booted in Windows, just rebooted), grub has disappeared, booted in Windows by default, which apparently has taken over the UEFI boot. By booting from a USB drive w/ CentOS7 LiveGnome, I could use its grub command prompt to inspect the UEFI of the local SSD drive, see that the centos/ sub-directory and files are still there. /boot/efi/EFI/centos/: BOOT.CSV BOOTX64.CSV fonts grub.cfg grub.cfg.1501243846.rpmsave grub.cfg.1505469290.rpmsave grubenv grubx64.efi mmx64.efi shim.efi shimx64-centos.efi shimx64.efi maybe /boot/efi/EFI/Boot/ contents has been altered? /boot/efi/EFI/Boot/: bootx64.efi fbx64.efi I had a backup of the full efi partition (`dd`) but it's outdated and I feel it's a bad idea to restore the partition from it. Still from this "external" grub prompt, I could boot into my CentOS7 using: configfile (hd0,gpt1)/EFI/centos/grub.cfg At least I know how to get back to it :-). But now, how could I give the UEFI control back to grub? Is there a grub2 or grubby command I can run to make grub the default? I've read a lot and still cannot figure out exactly what to do or don't dare running commands that could make things worse. And I have the feeling the at next Windows boot, I may need to do it again.. Regards, -- wwp

3 9

Set LANG on CentOS 6 server
by Nicolas Kovacs 24 Feb '18

24 Feb '18

Hi, I'm having a weird problem on a CentOS 6 server. I installed the machine in french, so I have LANG=fr_FR.UTF8 defined. I'd like to define en_US.UTF8, because some output is better readable in english, like chkconfig --list. I replaced fr_FR.UTF8 in /etc/sysconfig/i18n and /boot/grub/grub.conf. Unfortunately, when I reboot the system, I still get this: # echo $LANG fr_FR.UTF-8 Any suggestions? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 2

Network broke for a while when libvirtd start
by wuzhouhui 24 Feb '18

24 Feb '18

When start service libvirtd by service libvirtd start the network will broke for a while and then reconnected. Following is /var/log/messages: Feb 24 13:28:51 node-0 kernel: lo: Dropping TSO features since no CSUM feature. Feb 24 13:28:51 node-0 kernel: lo: Disabled Privacy Extensions Feb 24 13:28:51 node-0 kernel: virbr0: Dropping TSO features since no CSUM feature. Feb 24 13:28:51 node-0 kernel: virbr0: Dropping TSO6 features since no CSUM feature. Feb 24 13:28:51 node-0 kernel: device virbr0-nic entered promiscuous mode Feb 24 13:28:51 node-0 kernel: virbr0: starting userspace STP failed, starting kernel STP Feb 24 13:28:51 node-0 kernel: ip_tables: (C) 2000-2006 Netfilter Core Team Feb 24 13:28:51 node-0 kernel: nf_conntrack version 0.5.0 (16384 buckets, 65536 max) Feb 24 13:28:51 node-0 kernel: virbr0: topology change detected, propagating Feb 24 13:28:51 node-0 kernel: virbr0: port 1(virbr0-nic) entering forwarding state Feb 24 13:28:51 node-0 kernel: 8021q: adding VLAN 0 to HW filter on device virbr0 Feb 24 13:28:51 node-0 kernel: ixgbe 0000:02:00.0: eth2: detected SFP+: 3 Feb 24 13:28:52 node-0 kernel: ixgbe 0000:02:00.1: eth3: detected SFP+: 4 Feb 24 13:28:52 node-0 kernel: bonding: bond0: link status definitely down for interface eth2, disabling it Feb 24 13:28:52 node-0 kernel: virbr0: port 1(virbr0-nic) entering disabled state Feb 24 13:28:52 node-0 kernel: bonding: bond0: link status definitely down for interface eth3, disabling it Feb 24 13:28:53 node-0 kernel: ixgbe 0000:02:00.0: eth2: NIC Link is Up 10 Gbps, Flow Control: RX/TX Feb 24 13:28:53 node-0 kernel: bond0: link status definitely up for interface eth2, 10000 Mbps full duplex. Feb 24 13:28:53 node-0 kernel: ixgbe 0000:02:00.1: eth3: NIC Link is Up 10 Gbps, Flow Control: RX/TX Feb 24 13:28:53 node-0 kernel: bond0: link status definitely up for interface eth3, 10000 Mbps full duplex. OS: CentOS 6.5 libvirt: libvirt-daemon-1.2.5-1.mira1.x86_64 Does anyone know the reason?

2 2

a few simple questions about upgrading an "official" centos 7 release
by Robert P. J. Day 24 Feb '18

24 Feb '18

again, some fairly trivial(?) questions about working with centos 7.4, given my time immersed in fedora so i want to make sure i'm not carrying over any bad habits. first, is there anything untoward in updating an installed version of centos 7.4 with a simple "yum update"? i'm well aware of keeping in mind the goal of stability with centos, so am unsure what the philosophy is of pulling in new updates as cavalierly as i do with fedora. currently, "yum list updates" shows me 206 possible updates; should i have any concern about updating packages coming from the standard centos repos? next, are there any issues replacing yum wihth dnf? i found this piece: https://www.vultr.com/docs/use-dnf-to-manage-software-packages-on-centos-7 which suggests it shouldn't be a problem. thoughts? finally, any concerns i should have about upgrading the kernel from 3.10 to 4.14 or 4.15, as explained in a number of places like this: https://www.tecmint.com/install-upgrade-kernel-version-in-centos-7/ i simply prefer to run a current kernel but i can resist the temptation if upgrading that on a centos 7.4 system would introduce more problems than are worth it. thoughts? rday

5 7

what is the centos/elrepo policy toward LTS kernels?
by Robert P. J. Day 23 Feb '18

23 Feb '18

i'm sure there's a simple answer to this -- i already understand that newer kernels than the ones shipped with the official release aren't officially supported but there is the elrepo kernel repository here: http://elrepo.org/linux/kernel/el7/x86_64/RPMS/ with a mixture of long-term (lt) and mainline (ml) kernels. i assume that the mainline kernels pretty closely track the latest kernel release but that's not the one i'm interested in. if i was interested in the additional longevity of the LTS kernels, i can see that 4.4 is available. but the most recent LTS kernel was 4.14, was it not? so why is a 4.14 "lt" kernel not available in that repository? i am obviously unclear on the policy used to determine which kernel versions end up in that repository. rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss