- Discuss - lists.centos.org

CentOS-announce Digest, Vol 3, Issue 16
by centos-announce-request＠centos.org 27 May '05

27 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Official CentOS CD/DVD Vendor Program (Johnny Hughes) 2. CESA-2005:413 Important CentOS 4 x86_64 ImageMagick - security update (Johnny Hughes) 3. CESA-2005:413 Important CentOS 4 i386 ImageMagick - security update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 May 2005 10:03:38 -0500 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] Official CentOS CD/DVD Vendor Program To: CentOS ML <centos(a)centos.org> Cc: centos-announce(a)centos.org Message-ID: <1117119818.1469.209.camel(a)myth.home.local> Content-Type: text/plain; charset="us-ascii" All, I would like to announce our Official CentOS CD/DVD Vendor Program. We currently have 3 vendors, and 2 more who are putting together their information. (Not bad ... the official program has been going for less than 12 hours :) The details of the program (how to get in it, what they give back to the CentOS Project, etc.) are here: http://www.centos.org/images/CentOS_CD_Vendors.pdf Here is the page that contains the current vendors: http://www.centos.org/vendors The CentOS project has looked at the vendors listed, and we highly recommend them if you want to buy CentOS CDs or DVDs. They give back to the CentOS Project for every CentOS CD/DVD they sell and we greatly appreciate it. If you are a CD/DVD vendor and are interested in being in our official program, see the above guide. If you are a CentOS user looking to buy CDs or DVDs, please use our official vendors to get all your pre-made CDs or DVDs (not just CentOS products) ... and if you are buying other products from them because they are official CentOS vendors, let them know that is the reason :) Thanks, Johnny Hughes

1 0

bash 3.0 freezes
by jose luis faria 27 May '05

27 May '05

Hello centos users, I download the bash 3.0 and compile it in CentOS 4.0 with or withiut all patchs. But when I execute the comand ls -l it freezes. Any idea? -- :) cumprimentos -------------------------- José Luís Faria

2 1

mouse issues in centos 4
by Mark Elam 27 May '05

27 May '05

Hi all, I am the IT department here at my office, I take care of everything pretty much. I chose Centos4 to deploy to my 50 workstations as it was the most compatible with the RHEL. We need the RHEL compatibility for support contract for different tools we use. So far it has been great. I have noticed a few issues since having 50 machines all exactly the same installed with centos 4. I have them clustered, and generally they work well. I often see random loss of the mouse cursor, which results in having to restart X. (really pisses the engineers off) I cannot seem to track down why this is happening. Nothing in any logs give any clue to what is happening. I thought it may have to do with VMware, as this is installed on 80% of these machines, and most of the time it happened when users were using Vmware. But recently I have seen the problem on machines without VMware running or even installed. I have also noticed a similar issue with a Wacom tablet. The user will be using it for some amount of time and then it stops working. At first it is assigned /dev/input/event3, the kernel module (wacom.o) is loaded and everything is fine. It will then stop working after a while, behind the scenes the system thinks the tablet has been unplugged and replugged, then assigns it /dev/input/event4. This of course doesn't work because in the xorg.conf file it is looking for it at event3. I am not sure if these are related or not. But the symptoms seem similar. Of course the wacom tablet is USB and the mouse issues are with PS/2 mice. So they may be unrelated. Any help would be appreciated. Thanks for your time. -- ############################################################################# Mark Elam Direct: 408.869.4029 IT Administrator Cell: 408.221.2689 Mobilygen Corporation melam(a)mobilygen.com #############################################################################

4 4

can't locate /etc/ini.d/mysqld file!
by israel.garcia＠cimex.com.cu 27 May '05

27 May '05

List, I installed my server and I want to start Mysql, but I can not find the file /etc/ini.d/mysqld .. [root@netflow ntop]# rpm -qa|grep mysql mysqlclient10-3.23.58-4.RHEL4.1 libdbi-dbd-mysql-0.6.5-10.RHEL4.1 mysql-4.1.10a-1.RHEL4.1 mysql-devel-4.1.10a-1.RHEL4.1 Am I missing some mysql rpm from Cds? regards. israel

6 6

Re: [Centos] Mounting Netware Volumes
by Nels Lindquist 27 May '05

27 May '05

On 24 Mar 2005 at 19:33, Paul wrote: > Well I dug though the RH's site and in the release notes for AS 3.95 ite > mentionsed that ncpfs has been deprecated. I can't find the release > notes for 4, but assume that they must have removed support in the > kernel along with the package. Try installing the kernel-unsupported module. Both ncpfs.o and ipx.o (should you still require it) are in that module, at least for CentOS 3.x--haven't looked at 4.0 yet myself. ---- Nels Lindquist <*> Information Systems Manager Morningstar Air Express Inc.

5 6

Re: Demonizing generic Linux issues as Fedora Core-only issues -- this thread has ended ...
by Bryan J. Smith <b.j.smith＠ieee.org> 27 May '05

27 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > If you believe that, you have to believe that Red Hat's programmers > are always better than the original upstream program author. How do you assert that? It has _nothing_ to do with my statement. You keep thinking there is this absolute "black/white" on why developers, vendors, etc... do this or that. There are reasons to upgrade to a newer version, and there are other reasons to backport. One is _not_ better than the other, or developers are not any more or less "smart" if they do. What I said was it is _harder_ for a distro to take the take to backport fixes and minimize impact to existing compatibility than to merely just rely and ship the latest version from a developer. There are reasons to upgrade (features, project support, etc...) and there are reason to backport (minimal impact, regression tested inter-package compatibility, etc...). There is no "black/white" on which one is "better." I just merely stated _why_ SLA guaranteed distros do the "backport," which is more difficult to accommodate because the project developers/support typically are just focused on the next version, and you have to replicate much of their knowledge/expertise internally (instead of just taking their next version with the patches/fixes). > I'll agree that they are good and on the average do a good job, but > that stops far short of saying that they know better than the > perl (etc.) teams what version you should be running. And _where_ did I say that? All I said was that _backporting_ is done to _minimize_ impact to the _entire_ set of _all_ packages that have been "regression tested" into a released, SLA guaranteed distro. That's what RHEL/SLES are about. At what point are you going to stop seeing what I saw as a black/white thing and realize that RHEL/SLES have _different_ foci than what you may want, and _that's_ why you're not getting what you want in stock CentOS? Is it really that hard to understand? When you understand that there is a pro/con to "staying current" v. "backports," and why distros like RHEL/SLES are typically "anal" to the "backport" side -- which seemingly conflicts with what you want, then we can talk. Until then, you seem to want to assert that what I'm saying is something about "better" when that is _not_ what I'm saying. I'm trying to explain "why" -- _not_ "better." End of thread. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

About tunnels
by Maciej Żenczykowski 27 May '05

27 May '05

Hi folks, I have two CentOS 4 server I administrate doing routing and firewalling of two networks (one NATed and firewalled and the other one merely firewalled) and I'd like to build a tunnel to allow computers on the normal private network (and the firewall) to access the private IPs of computers behind the NAT/firewall. ie. ALPHA BETA 10.0.0.0/8 - CentOS4 - internet - CentOS4 - X.Y.Z.0/24 Private IPs Firewall Firewall Public IPs and NAT now the internet is intracity, within one provider and decently safe (6 hops), but still some sort of encryption would be nice... (otherwise I'd just use ip tunnel). How do I allow both BETA and X.Y.Z.0/24 to connect to the private IPs? Should I use CIPE? IPSEC? something else? any good howtos? Preferably something fast and reliable, doesn't need to be that easy to set up :) I'm basically looking for comments, I have looked around on google, and it seems there's _tons_ of options, but IPSEC seems to be winning out... am I correct in that assumption? Cheers, MaZe.

2 1

Re: [CentOS] Re: Official CentOS CD/DVD Vendor Program
by Bryan J. Smith <b.j.smith＠ieee.org> 27 May '05

27 May '05

From: Chris Mauritz <chrism(a)imntv.com> > If this was going to be a 100 unit/day or 1000 unit/day affair, I'd > agree with you, but it simply isn't. One or two people with cheap CD > and DVD duplicators, a paypal merchant account, and some time on their > hands is probably still overkill for the volume of sales, especially > when the product is available for free to anyone with a broadband > connection and a burner. Capacity planning. It's better to make only $500 and miss out on $1,000 than to have orders of $10,000 and only be able to service $2,500. > No, not really. What this says to me is that the CentOS team is doing > all the labour and some unecessary middleman is skimming the cream off > the top. Wouldn't you like to see the CentOS project receive more of a > share of the take for doing most of the work? I would. No, CentOS is focusing on what it does best and tapping others to do what they do best. But as someone else pointed out, form a CD/DVD duplication reseller and make a better offer and CentOS will likely take you up on it! > Spare me the condescending remarks. You knew what I meant. You mega-oversimplified, so no I did not. It's one thing to volunteer, that's great. In fact, at first, I thought that's what you were doing. But then you started to post all these things that just were like a "slap in face." Looking from the viewpoint of those CentOS managers who "put the time" and, more importantly, the _detail_ in on this, you showed you didn't have the faintest idea of what was involved. Again, as someone else pointed out, form a CD/DVD duplication reseller and make a better offer and CentOS will likely take you up on it! In fact, although there are the "minimal requirements" of $1/set under this plan, there's _nothing_ stopping different CD/DVD duplication resellers from playing a game of "one-up-manship" to gain the title of "highest proceeds" to CentOS. So instead of being so negative on what the leaders of this project have done so far, from a standpoint that was rather "shallow," why not be constructive and go ahead and offer to be a CD/DVD duplication reseller! The terms of the program are there -- go for it! You're open to it! ;-> > Looking back at the volume in the "demonizing" thread, I think I don't > have nearly the same amount of free time to spend jousting about > something so trivial in this mailing list with you. You're obviously a > very opinionated guy Oh, very, very much so. I am extremely opinionated. As far as "free time," I write for part of my living, and much of it comes from discussions on boards like this. As far as my "day job," it's largely 8x5, one advantage of being a traveling consultant that does more "architecture/design" than "analysis/support." > and often full of very sage advice to go along with the voluminous > opinion. Opinion to one is experience to another. I have _no_problem_ taking years to gain the trust of people. I think credentials don't mean squat, and trust comes from hearing people say things and finding out if they are applicable and useful over time. Again, even years. > But I found this reply to be more than a bit obnoxious. As did I your "volunteering." It's one thing to honestly "volunteer." It's another to belittle the initiative of the managers of this project who obviously took far more time, attention to detail and actually work to get the program going. There is no reason why you can't "volunteer" under this program by becoming a CD/DVD reseller yourself, under the same terms as any other. If you honestly believe you can do it better and cheaper than the current vendors who are signed up, then please do! We would all benefit if you did. That's all I was saying. And yes, I did berrate much of what you said for the reason I just explained. > The point of my message is that it seems like the CentOS guys > are doing all the heavy lifting and companies that (at least to me) > add very little value are taking the lion's share of the revenue for > these CD/DVD sets. As are arm-chair users who don't take the time to understand the details involved on things like this. I have taken what at least one other has said and re-gurgitated what you _can_ do under the program's terms that does _exactly_ what you want to do. So I suggest you consider becoming a CD/DVD duplicator/reseller yourself then. BTW, I might not be involved with CentOS, but I'm trying to do my (small/ too-small-to-even-speak-of) part on Fedora, which affects both RHEL and CentOS. And I can fully appreciate all of what the CentOS project does. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 27 May '05

27 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > Thanks - as you probably know, the long-winded discussion isn't > really about CIPE specifically so much as the philosophy behind > bundling a few thousand things together and then trying to > please anyone with a blanket policy about maintaining backwards > compatibility vs bug fixes vs new features. You just can't please everyone. But it does help if people focus on "why" something is done -- the pros/cons versus doing something else -- instead of trying to assert what is "better" (as well as stopping to listen to someone and realize they are not asserting anything as "better," just trying to explain "why"). CentOS is based on RHEL. RHEL has its policies. > And while I realize that there may never be a good solution, I'll be > really happy if some new options fall out of it, like this being > included in a centos kernel-unsupported-something-or-other package. I think CentOS is optionally filling that gap between FC and RHEL quite well for those that want it. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: Official CentOS CD/DVD Vendor Program
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

My $0.02 ... From: Chris Mauritz <chrism(a)imntv.com> > What's the point? Awareness, partnerships, retail notoriety and most of all, a starting point for now. You have to start somewhere. > I checked out linux cd mall. They charge $12.50 for the CD set (or DVD) > and CentOS makes ONE DOLLAR. Unless you envision tens of thousands > of people buying CDs, it hardly seems like a worthwhile endeavor I can envision that volume per year. > unless you're the CD distributor. The CD distributor has the economies-of-scale in the fact that they already have a built infrastructure, web front, relationships, etc... that CentOS can tap. For CentOS to build the same infrastructure, it would cost far more per unit sold -- at least at, again, "a starting point for now." > Why not just find a way to make it easier for people to donate directly > to the project instead of creating a needless middleman who is taking > 92% of the money for each CD/DVD set sold? Again, costs involved are relevative here. > Hell, for 92% of the profit, No, that's 92% of the _revenue_, and _not_ the "profit" (sometimes I think some Linux advocates need a refresher course in basic microeconomics ;-). There are more costs involved than just CD duplication here. > I'd be more than happy to sit at home and burn DVDs all day. And take orders? And handle shipping? And resolve issues with the site, customers, MC/VISA complaince on e-commerce, etc...? You can only do so much on your own before you need someone already doing it who can do it for much cheaper. > Where do I sign? 8-) You sign next to "I will learn how the infrastructure and operational costs of e-commerce works before I speak again." ;-> More seriously now, does everyone have to question everything around here? You don't think the management hasn't thought of these things? Why does everyone seem to believe they know better than the management who not only volunteers their time, but puts in the hours to be productive, including all the "less fun stuff" in the logistics and attention to detail? More pertinent, if you make posts like this, that are only include 5% of the actual details involved with doing such (and expose what can only be termed ignorance of the other 95%), how seriously do you think people can take your comments? I didn't. ;-ppp -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

insmod ip_conntrack_ftp
by Mickael Maddison 26 May '05

26 May '05

Hello CentOS, Is there a specific RPM that makes "insmod ip_conntrack_ftp" available? I've been using that on a number of servers fine, but the latest one I've built, running insmod ip_conntrack_ftp gives me: insmod: can't read 'ip_conntrack_ftp': No such file or directory -- Best regards, Mickael mailto:mike@kamloopsbc.com www.MickaelMaddison.com

3 3

Re: Demonizing generic Linux issues as Fedora Core-only issues -- why I hate these meta-discussions ...
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: "Bryan J. Smith <b.j.smith(a)ieee.org>" > You are indeed correct (I must have been looking at the RHEL3 dir**) First off, that's now 2 strikes for me. Small ones considering the context well outside of the points, but still it hurts my credibility. This is one of the things I hate about meta-discussions, at least how I approach them. Sometimes I just need to learn that it doesn't matter how many additional examples I give, some people aren't going to do anything but blame Red Hat. And by giving example after example, or attempting explain item after item, I'm going to eventually slip up from memory from time-to-time, which hurts my credibility -- regardless if the actual mistake was small given the context of the discussion. Sigh, there is a point where one should just resign and submit to the fact that if something doesn't work for someone, and { Microsoft, Red Hat, SuSE, even Debian as of late, etc... } is involved anywhere at all (even if it's a fork to another architecture -- e.g., anyone who has dealt with Cobalt/Sun releases, a primary reason for Red Hat's latter trademark enforcement ;-), the other person has no interest in understanding the "root" cause and will not see anyting to the contrary. My apologies for tying up the list with this non-sense. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: Demonizing generic Linux issues as Fedora Core-only issues -- MySQL 3 v. 4 linking licensing issues
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > RHEL-4 shipped with MySQL 4.1.x (and has a 3.23.58 client to work with > older databases) ... the latest SRPMS are mysql-4.1.10a-1.RHEL4.1.src.rpm > and mysqlclient10-3.23.58-4.RHEL4.1.src.rpm. You are indeed correct (I must have been looking at the RHEL3 dir**): ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4/en/os/i386/SRPMS/ Hmmm, that's actually a _major_ variance from Fedora Core 3: http://download.fedora.redhat.com/pub/fedora/linux/core/3/i386/os/Fedora/RP… [ **NOTE: I have not supported MySQL since the RHL9/RHEL3 series, hence why I didn't know it off-hand, just of the linking issues with version 4. ] Which begs the questions: 1) How much testing did it get in the Fedora Development/Core series? 2) How did they solve some of the linking issues I've heard about? As I mentioned before, the current Fedora Core 4 Test has it too, so I have to assume one of the following: A) Red Hat negotiated a license to redistribute as built as before but now for MySQL 4 (not likely since even FC4 has it now, unless the license also applies there, but I doubt it based on how Red Hat makes sure any FC/FE packages are always 100% redistributable by others) B) Red Hat shifted away from the few static links that it has previously used (more likely?) C) The packages causing the linking licensing issues have change their licensing? (NuSphere possibly?) D) MySQL AB changed its stance on linking in MySQL 4 as of v4.1? Anyone know the answer? I have to go back and research why Red Hat stuck with 3.23 and see how they are now redistributing 4.1x? > CentOS-4 has the identical programs {as with all other items except > LOGOS, trademarked text, and yum and where updates are done} in it's > base :) Which is why I love it. I must have just looked at the wrong directory. I'm also very disturbed that Red Hat would not give the public time to test in the leading community releases. If I had to speculate, I'd say it's because it was already testing in most other distros, but I'll have to read up in Bugzilla on why the change was made (as well as what allowed Red Hat to change it's stance on MySQL 4 in the first place). -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

CentOS-announce Digest, Vol 3, Issue 15
by centos-announce-request＠centos.org 26 May '05

26 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:413 Important CentOS 3 i386 ImageMagick - security update (Tru Huynh) 2. CESA-2005:413 Important CentOS 3 x86_64 ImageMagick - security update (Tru Huynh) 3. CESA-2005:472 Important CentOS 3 i386 kernel - security update (Tru Huynh) 4. CESA-2005:472 Important CentOS 3 x86_64 kernel - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 May 2005 00:46:09 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2005:413 Important CentOS 3 i386 ImageMagick - security update To: centos-announce(a)centos.org Message-ID: <20050525224609.GA30869(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:413 ImageMagick security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2005-413.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/ImageMagick-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-c++-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-c++-devel-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-devel-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-perl-5.5.6-14.i386.rpm source: updates/SRPMS/ImageMagick-5.5.6-14.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update ImageMagick\* Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Re: Betr.: [CentOS] VPN
by Peter Farrow 26 May '05

26 May '05

Hi there, yes it was with a Nortel contivity on a few occassions and the other times with a Cisco pix. interstingly enough the Cisco VPNs often required updates to the IOS to make them 3Des compliant, As its late here in the UK (past midnight GMT+1) here is a very quick and dirty freeswan guide. Needless to say the things that cause the biggest headache for most users is the use of RSA keys and opportunistic encryption. Since this is NOT what 99.9% of the masses need or want then there is a quick and simple and just as secure alternative setup, but its not that well documented. Opportunistic encryption came in versions 2 and above of freeswan by default, this has the effect of clobbering the network default route and replacing it down the ipsec interface (what you want if you want to encrypt everything, but not really any great use in the real world). Most people want to do site <-> site vpns and these are best achieved without opportunistic encryption and by the use of preshared keys. 1)Make sure you get a version of freeswan suitable for your kernel, if you can't find one go to somewhere like rpms.pbone.net and find a kernel for which there is a freeswan version. Many people try and hunt a freeswan version to match their kernel, I do it the otherway round, find the latest freeswan compatible kernel you can for your architecture, you can always compile it from source but why my life harder for yourself. 2)get the freeswan module for the kernel you found, and the same freeswan-userland version as well. then proceed as follows: after you have installed the [from rpm] Typically to kill opportunistic encryption add these lines to your ipsec.conf file: after the config setup section near the top, conn block auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn clear auto=ignore conn packetdefault auto=ignore Doing this stops all the crap you get when ipsec starts and then kicks you off the system about 60 seconds later if you're connected remotely as this kills the opportunistic setup feature. Do the same at the other end as well. Then start the service. Then add a section for each tunnel you want to set up. if you have multiple subnets at each site which can't be encapsulated in a single subnet declaration, you will need to add a new tunnel defintion for each. Here is an example : conn site1-site2 #this is the connection name [tunnel] identifier left=21.21.100.10 #This is the ip address of the first linux box leftnexthop=21.21.100.9 #This is usually set to the defualt gateway for the first linux box leftsubnet=10.11.2.0/24 #This is the LAN subnet behind the first linux box right=21.21.100.178 #This is the IP address of the second linux box at the other end of the tunnel rightsubnet=10.11.4.0/24 #This is the LAN subnet behind the second linux box rightnexthop=21.21.100.177 #This is the IP address of the default gateway setting of the other linux box authby=secret #We are going to use a "password" or secret to encrypt/auth the link pfs=no #Turn off perfect forward security, this makes it faster and easier but less secure auto=add #Authorise but don't start esp=3des-md5-96 #encapsulating security payload setting, encryption used for auth and data Now cut and paste this and add it to the ipsec.conf file on the second machine completely as is, unmodified. Then in you /etc/ipsec.secrets file on each machine you will need to add a password [secret] for each each of the tunnels you have specified, in the above example we would have: 21.21.100.10 21.21.100.178 : PSK "a-passwordin-here-with-the-quotes" Add this to the very top of the ipsec secrets file, one entry for each pair of machines in this format leftmachineip rightmachineip : PSK "password" Then do a service ipsec restart on each machine, bring the link up with this command, it only needs to be invoked from either one of the ends ipsec auto --up site1-site2 You should get output like this if you did it right: ipsec auto --up site1-site2 104 "site1-site2" #2086: STATE_MAIN_I1: initiate 106 "site1-site2" #2086: STATE_MAIN_I2: sent MI2, expecting MR2 108 "site1-site2" #2086: STATE_MAIN_I3: sent MI3, expecting MR3 004 "site1-site2" #2086: STATE_MAIN_I4: ISAKMP SA established 112 "site1-site2" #2087: STATE_QUICK_I1: initiate 004 "site1-site2" #2087: STATE_QUICK_I2: sent QI2, IPsec SA established Remember you will need to allow the ipsec interface in your firewall and you will need to add lines like this: # Accept udp connections to port 500 for ipsec $IPTABLES -A INPUT -p udp --sport 500 --dport 500 -j ACCEPT $IPTABLES -A OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT This is just about the quickest way to set up a VPN tunnel with Freeswan, it takes minutes. If you want to make if more secure, you can tune the config once you get it running this way! Remember the only machines that can't see the full extent of the other LAN network are the linux boxes creating the tunnel. So the left linux box will not be able to ping stuff on 10.11.4.0/24 network and the right linux box will not be able to ping stuff on 10.11.2.0/24 network - don't forget this.... its commonly mistaken by some to mean the tunnel isn't working, to truly test it end to end you need hosts on the LANs at each end to ping each other. If you want to make it work through NATing gateways you will need to port forward the udp 500 setting above on your firewall. Enjoy! Pete Kennedy Clark wrote: >Any chance of getting a quick HOW-TO posted to the group for that? >;-) Sounds interesting. > >I saw your post about using it with Cisco & Nortel equipment -- I work >with both a lot at my current customer. What types of equipment have >you used it with from both vendors (e.g., Cisco: IOS, PIX, VPN3K; >Nortel = Contivity)? > >Thanks!! >Kennedy > >

3 13

Re: [CentOS-announce] CESA-2005:472 Important CentOS 3 i386 kernel - security update
by John Newbigin 26 May '05

26 May '05

The yum headers for these updates seem to be incomplete or out of date... perhaps only for non i686 arch. 0:kernel-source-2.4.21-32.EL.i386=RPMS/kernel-source-2.4.21-32.EL.i386.rpm Tru Huynh wrote: > CentOS Errata and Security Advisory 2005:472 > > kernel security update for CentOS 3 i386: > https://rhn.redhat.com/errata/RHSA-2005-472.html > > The following updated file has been uploaded and is currently syncing to > the mirrors: > > i386: > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.i586.rpm > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-BOOT-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-doc-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-hugemem-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-hugemem-unsupported-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-smp-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-smp-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-smp-unsupported-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-smp-unsupported-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-source-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.i586.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.i686.rpm > > source: > updates/SRPMS/kernel-2.4.21-32.0.1.EL.src.rpm > > You may update your CentOS-3 i386 installations by running the command: > > yum update kernel\* > > Tru > > > ------------------------------------------------------------------------ > > _______________________________________________ > CentOS-announce mailing list > CentOS-announce(a)centos.org > http://lists.centos.org/mailman/listinfo/centos-announce -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin

1 0

Re: [CentOS] Re: Centos and SAMBA
by Robert Moskowitz 26 May '05

26 May '05

At 05:14 PM 5/25/2005, Bryan J. Smith <b.j.smith(a)ieee.org> wrote: >From: Robert Moskowitz <rgm(a)htt-consult.com> > > I meant what is Centos equiv to in terms of Fedora. > > As the scripts I am using are set up for core 4. > >Fedora Core 4 isn't even out yet. Test 3 just hit the other week. I do not know where I got that core 4. My blunder. Barrs Law of Recursive futility If you're smart enough to use one of these.... .....you can probably manage without one!

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > Yes, but... whose choice was it to ship 2.6 with lots of broken > and omitted stuff when 2.4 works better for many things? Again, 2-2-2, 6-6-6 At some point, Red Hat has to start the new series for "early adopters." That means being the first to adopt the new GLibC, GCC, kernel, etc... Looking at just the GLibC 2+ generations (post-LibC4/5)... EL0 series: GLibC 2.0, GCC 2.8.1.1, kernel 2.0 EL1 series: GLibC 2.1, GCC 2.91.66 (EGCS 1.1.2), kernel 2.2 EL2 series: GLibC 2.2, GCC 2.96, kernel 2.4 EL3 series: GLibC 2.3, GCC 3.2, kernel 2.4 EL4 series: GLibC 2.4, GCC 3.4, kernel 2.6 In each 2-4 "Community Linux" revisions of those "Enterprise Linux" series, Red Hat minimizes changes. Typically the .0 can go through a number of refinements from .0 to .1, but then they taper off in preparation for the .2 and 18 month EL series. But even what I call CL4.0 (Fedora Core 2) wasn't nearly as much of a shift as CL0.0 (Red Hat Linux 5.0), and still a bit better than CL2.0 (Red Hat Linux 7[.0]). One of my only complaint starting with Red Hat Linux 9 (_well_before_ Fedora Core) is the lack of revisions to warn us of ".0" like shifts. > Just because a developer writes some code and tacks on a higher > version number doesn't mean it's ready for prime time. Correct. I never said so and I have been _very_critical_ of Red Hat no longer using revisions to tell us that its either a major shift (.0) or an evolutionary update (.1, .2, etc...). And this was _before_ evne Fedora Core. Red Hat should have called Red Hat Linux 9 as Red Hat Linux 8.1. Yes, they added NTPL, but there have always been a few changes from a .0 to a .1 as things are more finalized. Every .0 revision has made some poor considerations in a few regards, and after the "early adopters" start using it, they are exposed. The reality is that most things are _not_ exposed _until_ people actually start using things. Even Red Hat Linux 7[.0] was regression tested to the anal power with GCC 2.96 and its ANSI C++ requirement, and it wasn't until after Red Hat released it that the projects that weren't writing ANSI C++ compliant software took note. People like to throw up the fact that Red Hat included GCC 2.91.66 (EGCS 1.1.2) for kernel building and that's why they should have gone with GCC 2.96, but I will return point out that many distros were shipping GCC 2.95 as well, and GCC 2.95 had a lot of issues with various software too. > Well, an occasional rant is therapeutic - or at least cheaper than > smashing the equipment that no longer works after you upgrade the > software. Constructive rants are good. They identify real technical issues. But "brand name" rants are typically full of ignorance, blaming companies for things outside their control, or outside their focus (e.g., features on a SLA-centric distro). Again, I think it's good to see projects like CentOS, but that doesn't mean you have to complain about Red Hat on things that are not Red Hat's doing or focus. The principles of configuration management are universal, and one must be wary of any new version, regardless of where it comes from. In the past, Red Hat made this very easy with revisions. With RHL9+, I think Red Hat really needs to bring them back. > I'm questioning the sensibility of shipping a kernel in what should be > an upgrade If Red Hat doesn't do it, another distro will. And then that distro can be chastized by people like yourself instead of Red Hat, and Red Hat will benefit from being on the trail that other distro's issues. I purposely kept my CL3.2 (Fedora Core 1) systems well after CL4.0 (Fedora Core 2) came out, and didn't upgrade until CL4.1 (Fedora Core 3) was released. I did the same of CL2.3 (Red Hat Linux 7.3) until CL3.1 (Red Hat Linux 9) came out, CL1.2 (Red Hat Linux 6.2) until CL2.1 (Red Hat Linux 7.1), etc... It's best to wait on a new distro series until 1 year after it first starts development, typically 6 months after it's first revision's release. Fedora Core 2 was _very_stable_, but it was _very_incompatible_ with many things because of its changes. Those compatibility issues will _not_ get resolved until someone finally releases an "early adopter" release and people then start throwing things at it. Heck, even SuSE does this too. And SuSE even came out with their Linux 2.6-based enterprise distro much sooner than Red Hat. So you could easily "double" your chastizing of Red Hat towards SuSE in the same regard. At some point, Red Hat has to "give up" further development on Linux 2.4, or anything else, and "move on." There's nothing stopping you from delaying your adoption for 6+ months, or even 36+ months (in the case of RHEL/CentOS). I've had this argument over and over with people -- not just Linux. You can't always blame vendors for your own professional negligence. Sometimes vendors just ship what consumers want, even when they tell them "we don't recommend this." A perfect example was Windows 95/98/Me -- something I _never_ allowed on my networks (only Windows NT 3.1, 3.50, 3.51, 4.0 and 2000). And that means you don't just go off and upgrade when the vendors says "we've changed all the core stuff" which is a definite sign that things might break. Your option is always that you can stick with the older release. Again, 6+ months for Fedora Core today, 36+ months for RHEL/ CentOS. > with many things that don't work at all that worked in > the previous version. Of course not! That's what change does! ;-> Red Hat release 2-4 revisions every 6 months before changing things up. SuSE does much of the same as well, and more distros are moving to this model too. Things break, but the idea is to maintain 2-4 revisions over 12-24 months that don't. In the case of Red Hat and SuSE, they also release a distro every 18 months based on the "most mature" revision and then support that for 60+ months under a subscription model. Otherwise, the overwhelming distros don't do such a good job, and _any_ release of theirs can dork up anything! I'd really like to find a vendor who balances "early adoption" with "anal SLA-level reliably" so well and for so long. It's the 2-2-2, 6-6-6 model that everyone, even Novell-SuSE, have adopted. > As you point out, these aren't surprises. > While I hate to complain about free software, I think that user's > experiences are relevant and should be reported even if they are > painful. That's fine, if you report them. But then people go beyond that and start "analyzing." And when I say "analyzing" I mean they "blame the vendor." And the illogic doesn't stop there -- they will blame Red Hat for issues with CentOS, or not realize that Red Hat really did take time, effort and extensive consideration to get it to work, and couldn't. And not only that, but when other distros ran into the same issues. > I'm not sure I believe that in the case of CIPE, since the 1.6 version > specifically addresses the changes in the 2.6 kernel and was available > well before FC3 or RHEL4 releases which did not include it again. Both FC3 and RHEL3 started with FC2. And FC2 has already been through 6 months of development and Fedora Core 3 was already entering into Test by the time CIPE 1.6 was finally available. And even then there were issues -- let alone issues with security and the lack of interest. At some point Red Hat crosses a threshhold where they have to say it's too close to release date. There's just not enough time to not only integrate the package, but give its "due dilligence" in package test (Rawhide/Development), distro regression test (Beta/Test) and post-release resolution. And when a package doesn't get modified to support kernel 2.6 until some 9 months after kernel 2.6 release, and still has issues, at some point, Red Hat's gotta say "this is going to cause us headaches to support." > If I were to speculate about intentions as you suggest above, I'd > guess that someone at RedHat read the one negative review published > about CIPE, decided it was no longer a selling point, and walked away > from the integration they had done before. And I'd say you haven't looked through Bugzilla. I don't know how many times I've seen people complain about Red Hat and then a few of them actually take the time to submit Bugzilla reports and then realize what happens. The few that do then change their tune. Any and every major decision on EL begins with their development of CL. And that has not varied in Fedora Core since the days of Red Hat Linux 4.0 on-ward. If you want to see something change, you have to get involved. And that means taking the time to understand what you _can_ do to see things change. It's very easy in the Red Hat Linux world. And its even easier now that Fedora Core is no longer the "product" that Red Hat Linux is, even though Red Hat Enterprise Linux has a 1:1 package relationship just like Red Hat Linux prior. > But of course I wouldn't speculate about something like that... You don't need to. Hit Bugzilla. There are people who like to complain from ignorance. And then there are people who like to complain from familiarity. I typically choose to be the latter, although I'm sure I've done the former more than once too. > It's a complicated system, and it isn't immediately obvious that other > distros have exactly the same problems. Do you know how many times I hear people say that? And I just have to shake my head because it can't be categorized as anything else but ignorance? Do you know how many times I hear someone call something a "Fedora Core 2-only issue" yet it plagues SuSE Linux 9.1, even SuSE Linux Enterprise Server (SLES) 9 and Mandrake 10.x as well? And they will actually sit there and say "it's only a Fedora Core 2 issue" no matter how many times I send them links? Red Hat has its model and it is extremely effective. But it also means that you have to understand why the "end" of 2-2-2 and 6-6-6 is more "reliable" than the "beginning." Fedora Core 2 was the beginning. Red Hat Enterprise Linux 4 was the end. At some point, if you keep introducing latest'n greatest that still have compatibility issues, you are going to affect the quality of the end. > If you follow www.distrowatch.com for a few months you'll see that they > each keep trying to improve things in different ways. Yes, and the overwhelming majority of distros on distrowatch.com don't have a good release model, and they break all sorts of things everytime they come out with a new version -- at least in comparison to Red Hat or SuSE. > Switching distros should always be an option - that's one of the > big reasons for using open source. But sometimes people switch distros out of "brand name blame" instead of actual "technical focus." I don't know how many times I've seen people argue over 2 distros that use the _exact_same_ base! I've literally had people argue to death that APT is Deb-centric, and the RPM world doesn't have anything equivalent. And sometimes I think people aren't "up-to-date" on different distros because they used one from years ago, and their preference more currently. As someone who deploys Debian, Fedora, Gentoo, SuSE and RHEL and SLES regularly, there's a lot of overlap. > But, in spite of what I consider an occasional bad choice, Like CIPE I assume? At what point are you going to recognize that CIPE was really "no choice" until Fedora Core 3 was in Test? > Fedora/RH seem to be among the best and I do give the fact that > they've been responsible for getting buggy software in front of a > vast number of people credit for it eventually being fixed. "Buggy"? Or "incompatible?" Big difference! If GNU Tar is incompatible with POSIX, and someone introduces a new version or replacement program, like Star, that is, do you know how much the "ignorant majority" absolutely derail that person? Or when LibC5 is not getting the attention it needs, has security issues, yet GLibC2 is active, solves a lot of security and compatibility issues, etc...? Or when lack of ANSI C++ compliance hurts compatibility with future code, and GCC 3 is being finally pushed? Or when the fact that GCC 2.95 was adopted by many distros even when the GCC team said they should not and stick with GCC 2.91.66 (EGCS 1.1.2) which is proven (and the kernel uses)? > If you remember the state of free software before RH 4.0 was > released you will know what I mean. I do sometimes wonder > how things would have turned out if someone had built an equally > easy to install CD based on freebsd first, though. Who says it isn't and I don't also deploy FreeBSD and NetBSD? [ If you own the book "Samba Unleashed," you might open up the Appendix on BSD UNIX and see someone's name you recognize. ;-] > Hmmm, just who would you blame for WindowsME? Oh, that was Microsoft. Although oeople professionally negligent enough to ever allow _any_ "Chicago" release on their network were the start of the issue. Windows Me was Microsoft's attempt to get their own application developers to stop using "Chicago" interfaces. The result was that they created a release that was both incompatible and unreliable. As I always said about Windows, you had your choice between incompatible (NT) and unreliable ("Chicago"). I choose the former, and I was in the minority. But I didn't have 98% of the problems other people had. > Who would you blame for the upgrade that made interfaces not > start if the hardware address in the configs didn't match > the NIC? That was bad news for my remote machines where all > the drives had been cloned and the IP addresses set before > shipping. I'd blame you because you cloned, not installed. ;-> You can't blame Red Hat for an install approach they don't test for. [ BTW, Ethernet hardware addresses are used in IPv6. ] > I'm not positive about this, but I think it happened > at about the same time across Fedora/RH/Centos updates instead > of following the scenario you mentioned for testing things that > are supposed to change behavior. What version? I can tell you exactly if it was a major or minor change. .0 always changes stuff. Sometimes .1 changes a few things that didn't make it or needed to be addressed. .2 rarely does, as well as the "enterprise" release. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Betr.: [CentOS] Centos and SAMBA
by Thom van der Boon 26 May '05

26 May '05

Hi, I've setup a SAMBA PDC on Centos 4 last weekend and migrated my NT4 PDC (Users, Groups, etc) to the new Centos Server in a matter of a couple of hours. I've used the scripts and howto from: http://samba.idealx.org/smbldap-howto.en.html#htoc89 Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> rgm(a)htt-consult.com 25.05.2005 20:03:41 >>> Is anyone here doing real use of SAMBA as an NT domain controller? I have been attempting to follow: http://web.vcs.u52.k12.me.us/linux/smbldap/ Which is set up to work with Fedora core 4 (how is this equiv to centos 4?) It looks like I am rather far along. Hit my first obvious problem with the IMC populate script. It would be nice to have a centos version of all this.... _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Re: Centos and SAMBA
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Robert Moskowitz <rgm(a)htt-consult.com> > I meant what is Centos equiv to in terms of Fedora. > As the scripts I am using are set up for core 4. Fedora Core 4 isn't even out yet. Test 3 just hit the other week. I've been calling it the first version (.0) of a new EL5 series (CL5.0) because it switches to GCC 4.0. I haven't looked at it deep enough to see if other things have changed, but it's safe to say at this point, with RHEL4 out, Red Hat is looking to "shake things up" so don't expect FC4 to have the same compatibility as FC2-FC3-RHEL4. [ BTW, I caught a typo in my EL0-EL4 reference I posted before. Both EL3 and EL4 use GLibC 2.3, as does this new EL5. ] -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Centos and SAMBA
by Robert Moskowitz 26 May '05

26 May '05

Is anyone here doing real use of SAMBA as an NT domain controller? I have been attempting to follow: http://web.vcs.u52.k12.me.us/linux/smbldap/ Which is set up to work with Fedora core 4 (how is this equiv to centos 4?) It looks like I am rather far along. Hit my first obvious problem with the IMC populate script. It would be nice to have a centos version of all this....

2 2

Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > I'm still wondering about that... If anyone except Linus himself > even suggested that changing kernel interfaces in a way that would > break device drivers was a good thing, I can't imagine the reaction. > I could see that the changes through 2.4 were improving things, but > is there anything that is measurably better in 2.6 (at least compared > to the RH-patched 2.4)? I've been too busy trying to make some > firewire drives work as well as they did on FC1 to notice any other > changes. Agreed. But even Red Hat stands on the shoulders of Linus and the kernel developers. No matter how many people Red Hat puts on the kernel, there are still things outside of Red Hat's control. If you don't like what does or doesn't go into RHEL/CentOS, then you need to get involved with Fedora Core and make a case of what should. And one way to do that is to donate time. Because if it's not proven in Fedora Core to Red Hat's tastes, it doesn't go into RHEL/CentOS. So the most effective way you can influence RHEL, and therefore CentOS, is to get involved with Fedora Core. Red Hat is _not_ going to "force" something that it can't get to work with Fedora Core into RHEL arbitrarily. So if you don't see something in RHEL/CentOS as standard, you need to see why it didn't make it into Fedora Core. Once again, I will remind people that several people here _are_ indeed complaining about what doesn't come with RHEL, and not aware that it _does_: A) Not work in Fedora Core, and failure after failure keeps it out B) And is, subsequently, not going into RHEL where SLAs are involved C) Does _not_ come with pretty much _all_ other, similar distros Red Hat Enterprise Linux, like SuSE Linux Enterprise Server, are _not_ about features. Both 18 month releases are subsets of their 6 month revisions (even locales not supported in SLA are often removed). You are not paying for R&D and inclusion in the "Enterprise" flavor (although the funds _do_ pay for extensive GPL development, R&D and other integration attempts in Fedora Core and SuSE Linux). > Or with the logic of asking customers to pay extra to get something with > features removed... Again, the people who actually _pay_ for RHEL/SLES are _not_ paying for features. ;-> You are complaining about CentOS not coming with things standard, and then assinging blame for that to Red Hat, because you believe they are supposedly paid and should have more features. I can only label this as "ignorance" of how RHEL (as well as SLES) is developed, because anyone can go out to Bugzilla and see the detail of why something is not included. If you want the most features, then Fedora Core + { FE+Lorg, DAG, etc...} is your baby, maybe CentOS + additives if you don't mind waiting a year later. I think it's great that CentOS is trying to be the best of both worlds: SLA- quality with added features. But it really is "demonizing" when all I see is people making complaint after complaint about RHEL not having something when many, many, _many_ Fedora Development manhours were made trying to get exactly what you wanted working. At some point Red Hat has to say "this doesn't work, even if it works in 2-3 months, it still won't have time to 'bake' in usage, so we're dropping it from consideration for this version of RHEL." > I haven't seen anyone demonizing RedHat here. I see some people > reporting painful experiences, But people are going beyond reporting painful experiences. They are making conclusions and get "upset" when I give the technical details of why something wasn't included. If you care enough to want something I assume people are open enough to understand why it wasn't included. Microsoft is the company that doesn't do something unless their is at least 250,000 users. Red Hat, SuSE and others often try to do everything they can, even for maybe only 1,000 users, in their 6 month revisions. But at some point, if something really doesn't work, has security issues and just isn't something they want to stake their time and money on in a SLA (which can get _very_expensive_ for software company), they have to drop it. After all, after a thousand man-hours of attempted integration for even their Fedora Core release, are they really going to sign themselves up for yet another thousand-plus hours and nagging re-fix after re-fix when maybe only a couple hundred licenses of RHEL are actually going to hold them to it? Just remember what CentOS is based on, and how much work not only goes into that, but into making sure the distro works as advertised because SLAs are involved and that can get really costly for Red Hat if it ships something that is not well tested. Especially if only a few companies want it. > but I don't think anyone expects perfection and the best thing is to > learn from them. If people here should understand one thing from the Windows world, it is that features and quality can be mutually exclusive -- especially the farther you move away from the economies of scale. I just find it humorous that several people who use CentOS, a free redistribution of RHEL (where Red Hat doesn't see a dime), are not complaining about Linus & co. for the kernel, not complaining about the CIPE team and their lack of movement on kernel 2.6, not volunteering to even look at the Bugzilla reports to find out what issues were blantantly repeatable, let alone other distros that have the same issues ... But blaming solely Red Hat for this issue (and this is just one example). But I expect that because some people just blame Microsoft for things outside of their control too. Sometimes the only person to blame is the lack of interest by anyone. If that isn't ignorance, I don't know what is. -- Bryan J. Smith mailto:b.j.smith@ieee.org

3 2

OSS install problem
by Adrian Coman 25 May '05

25 May '05

Hi, I want to install the commercial version of OSS and test if Skype works better with it. The problem is that after I compile 2.6.9-5.0.5.EL without sound support and then install oss3992d-linux-x86-v26-regparm and make it start at boot, at boot time OSS fails because it can not find /dev/dsp /dev/mixer and some other /dev sound devices. Indeed they do not exist. What do I need to do? Did I do something wrong or I have to manually add the /dev sound devices? Thanks, Adrian

2 3

CORRECTION: I must modify/clarify my statement about .0 releases ...
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

In looking through Red Hat's FTP site, I can find no such statement with regards to "do not use on production servers" in any README or Release Notes of Hurricane, Hedwig, Guinness or Psyche (Red Hat Linux 5.0, 6.0, 7 and 8.0, respectively). What I have found in my archives is a cutting from the official Red Hat Network (RHN) announcement of Psyche (8.0) that says two things: 1) It is an "early adopter" release, and 2) Do not upgrade "production systems" from Red Hat Linux 7.3 I cannot find the full version of it on-line. I know I do have an archived copy of at least the full Guinness and Psyche release announcements from the RHN and will search for them in my archives tonight. I kept _all_ official RHN messages, although I fear they are in an archive at a former employer that I do not have a copy of. It very much bothers me that I cannot find the same in at least the "Release Notes" of Guinesse or Psyche because I could have swore I saw them on CD #1 in one of my sets (and not a Rawhide or Beta release). If anyone has the original Guinness or Psyche announcements from their RHN subscriptions, please send them to me off-line. I'd like to confirm I'm not going senile after all, although some would love to have proof of that. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > We would not build and distribute either of these things if they were > not released via the GPL. The RPMS/SRPMS that we are distributing are > indeed GPL. We firmly agree with RedHat on this issue (that only GPL > things should be distributed). The problem is that many distros are statically building MySQL 4 with some non-GPL components. Some of the terms/definitions on static v. dynamic building changed from MySQL 3 to MySQL 4. I'll look into some of the latest Fedora Development and see if they are approaching such now. But one thing Red Hat seems to be doing is avoiding a lot of the MySQL 4 developments because of MySQL AB's changes. > CentOS will also not include in our repos anything that is not allowed > to be re-distributed due to patents or US DMCA. And I've noted that. I said that's why I don't use "pure" Fedora (Core, Extras) or Debian-bases (both RHEL and CentOS fall into that as well), and avoid both Livna.ORG and DAG in a commercial environment. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Mini-centOS
by kenkensmile＠netscape.net 25 May '05

25 May '05

I am using centOS for my server and centOS is extremely stable. I almost love centOS more than my wife. However, centOS is a bit heavy to run on my notebook (P III 1G, 256MB RAM). I need gnome, firefox, openoffice, realplayer, gaim, acrobat and thunderbird on my notebook, but if I install all of them (plus base-system), my notebook becomes very slow. I wish I could have a lighter version of centOS for notebooks and old desktops. Is there any project that I could have a mini-centOS in the future??? Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

8 8

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

Michael: I can recommend the Netgear WG511. This one has a prism chipset; ndiswrapper is NOT required! Outpost.com sells the WG511 so you can probably find it at Fry's as well for around $45. Note: I do not recommend the WG511T which is a different chipset!. --- Michael <addymin(a)pacbell.net> wrote: > Greetings: > > I'm just installed Centos-4 on an IBM T-21 laptop. So > far so good. Now > I'd like to pop in a wireless lan adapter. I'm looking > at a buying a > Linksys WPC54G adapter (although I haven't done so yet). > > After doing some searching, it looks like the best way to > get this card > working is via ndiswrapper > [http://ndiswrapper.sourceforge.net] and then > to use Windoze drivers. > > So I downloaded ndiswrapper and during the install, I > received a warning > message referring to "4K Stacks" and that NOT disabling > 4k stacks can > cause some drivers to crash. The docs went on to suggest > I recompile the > kernel to disable CONFIG_4KSTACKS. > > Question: For really like to stick to the stock CentOS-4 > kernel and not > create/use a custom one. Has anyone had a problem using > the Linksys > WPC54G Cardbus adapter + Centos-4 and NOT had to use a > custom kernel? > > For that matter, since I haven't purchased the card yet, > can I get a > recommendation or two about a workable wlan cardbus (g) > adapter that > could most likely be found at Best Buy/CompUSA/Fry's ? > I'd like to be > able to easily return the card if things don't work... > > I did some searching a decent card and it seems that a > number of good > wlan chipsets are discontinued or hard to find, so I'm > slightly confused > as to what to get. > > Thank you. > Michael Chinn > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > This is not really true. We will probably never have everything that FC > has as added features ... but CentOS-4 has several added features and we > have been out for only a 3 months (so, not required to wait a year). Oh, sorry, I should have clarified. What I meant by "wait a year" was the time from the first .0 or .1 Fedora Core releases that a new version of RHEL/CentOS is based on. E.g., FC2 came out in May 2004, FC3 in November 2004. RHEL/CentOS 4 didn't follow until 2005. > We even have some features (mysql compiled postfix, NX/freeNX, > and soon MySQL-Administrator / MySQL-Query Builder) that are not > yet part of FC or FC Extras at all. Actually, some of this stuff will _never_ be included in FC/RHEL because of licensing issues with the fact that MySQL is GPL. This is well documented in a lot of places. Red Hat is the only distributor (although I haven't checked Debian) fully honoring the terms MySQL AB sets on its GPL releases of MySQL 4, which include not building and redistributing certain items. It's one of those things that Red Hat also gets chastized on, and one of the reasons I don't use DAG (or Livna.ORG) at businesses. Anything that has GPL licensing/mixing issues, "only for non-profit use" or otherwise is "questionable" use of patents is the reason why I stick with "pure" Fedora Core+Extras or Debian. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

CentOS4, KDE3.3 and 128 WEP
by John Logsdon 25 May '05

25 May '05

CentOS4 standard installation. I see that KwifiManager doesn't support 128 bit WEP which I need for other machines on the network, which is a bit of a blow - and rather surprising really as security should be quite a consideration on an enterprise level system (NB RH!). Is there a workaround? An alternative way of configuring my Belkin F5D6020 ver 2 card? eg a cvs download that I can get and copy via a stick? Or how to do it manually? I have tried regressing kdenetwork but that doesn't include kwifimanager at all. Ideas? TIA John John Logsdon "Try to make things as simple Quantex Research Ltd, Manchester UK as possible but not simpler" j.logsdon(a)quantex-research.com a.einstein(a)relativity.org +44(0)161 445 4951/G:+44(0)7717758675 www.quantex-research.com

3 9

file compatibility issue
by William Warren 25 May '05

25 May '05

I am trying to run a binary but the binary was complied on debian so the system throws me this error: libstdc++-libc6.2-2.so.3 This is Centos-4. How can i get that compatibility fixed? -- Computer House Calls, Networks, Security, Web Design: http://www.emmanuelcomputerconsulting.com What businesses are in Brunswick, Maryland? Check Brunswick First! http://www.checkbrunswickfirst.com My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD. -- carpe ductum -- "Grab the tape" CDTT (Certified Duct Tape Technician) Linux user #322099 Machines: 206822 256638 276825 http://counter.li.org/

4 12

iptables logging
by Peter Farrow 25 May '05

25 May '05

Hi All, A few years ago I was asked if I could redirect console messages from Iptables to a different virtual console, on RedHat 7.3 . I managed to do it, but can't remember how I did it, now that the same question has arisen ona Centos 3.4 box. I edited /etc/syslog.conf and redirected kern.* to /dev/tty2 for example & this didn't work I edited /etc/sysconfig/syslog and modified klogd options with -f /dev/tty2 & this didn't work either So I stopped syslogd and klogd altogether and iptables still logs to the current console (which ever one you're on). So my question is, how do I get iptables to redirect its output to another console? P. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

4 6

CentOS and HP Drivers
by Mark A. Lewis 25 May '05

25 May '05

I am debating installing CentOS on a new HP DL580 with an MSA1000 SAN. HP offers drivers that are specific to RHEL and will not install on other RH distros i.e. RH 9. Has anyone gotten the HP SupportPack to install under CentOS? Thanks! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

31 56

CentOS-announce Digest, Vol 3, Issue 14
by centos-announce-request＠centos.org 25 May '05

25 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:427 Moderate CentOS 3 i386 ethereal - security update (Tru Huynh) 2. CESA-2005:427 Moderate CentOS 3 x86_64 ethereal - security update (Tru Huynh) 3. CESA-2005:435 Important CentOS 3 i386 mozilla - security update (Tru Huynh) 4. CESA-2005:435 Important CentOS 3 x86_64 mozilla - security update (Tru Huynh) 5. CEEA-2005:434 Important CentOS 3 x86_64 - centosplus firefox security update (Tru Huynh) 6. CEEA-2005:434 Important CentOS 3 i386 - centosplus firefox security update (Tru Huynh) 7. CESA-2005:427 Moderate CentOS 4 i386 ethereal - security update (Johnny Hughes) 8. CESA-2005:427 Moderate CentOS 4 x86_64 ethereal - security update (Johnny Hughes) 9. CESA-2005:473-01: Moderate CentOS 2 i386 lesstif security update (John Newbigin) 10. CESA-2005:427-01: Moderate CentOS 2 i386 ethereal security update (John Newbigin) ---------------------------------------------------------------------- Message: 1 Date: Tue, 24 May 2005 22:59:07 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2005:427 Moderate CentOS 3 i386 ethereal - security update To: centos-announce(a)centos.org Message-ID: <20050524205907.GA10604(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:427 ethereal security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2005-427.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/ethereal-0.10.11-1.EL3.1.i386.rpm updates/i386/RPMS/ethereal-gnome-0.10.11-1.EL3.1.i386.rpm source: updates/SRPMS/ethereal-0.10.11-1.EL3.1.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update ethereal\* Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

Michael --- Michael <addymin(a)pacbell.net> wrote: > So I downloaded ndiswrapper and during the install, I > received a warning message referring to "4K Stacks" and > that NOT disabling 4k stacks can cause some drivers to >crash. The docs went on to suggest I recompile the > kernel to disable CONFIG_4KSTACKS. > > Question: For really like to stick to the stock CentOS-4 > kernel and notcreate/use a custom one. Has anyone had a >problem using the Linksys WPC54G Cardbus adapter + Centos-4 > and NOT had to use a custom kernel? I have used ndiswrapper on FC3 with the stock kernel without a problem. If you buy the Linksys card, try it first! > Thank you. > Michael Chinn __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new Resources site http://smallbusiness.yahoo.com/resources/

1 0

packages in centos-3.3 base changed
by Leonard Ye 25 May '05

25 May '05

Hi all, Correct me if my understanding is wrong. The [base] repository of centos-3.3 will never change after release. All future updates should go into [update]. I have an autobuild system to build a production server. If the [base] repository will never change after release, then I can maintain the reproducibility of the production server by always installing from the [base] of centos-3.3. Regards, Leonard Ye

1 0

Re: [CentOS] Re: Hi, Bryan; was: Re: pronunciation? <snip> -- don't shoot the messenger ...
by Bryan J. Smith 25 May '05

25 May '05

From: Dag Wieers > Sorry to interrupt but he was describing how you appeared in previous > postings. And I have to say that I felt the same way reading some of your postings. Really? Then I'll re-read them since there's been a second confirmation. Just know that I wasn't trying to make it about good/bad. I'm just trying to make the point that companies aren't just evil/greedy, and sometimes your friend can be your worse enemy (even SCO knows that one ;-). > Maybe it's best to move these topics to another channel. I just wish people didn't feel the need to make comments about Red Hat and SCO. > Can we leave the insults out, please ? > It serves no purpose here. Sorry. I'm just still a little disturbed about the "crap" statement, and everything that went with it. I find that many people just don't believe me sometimes.

6 20

announcement topics
by Joe Pruett 25 May '05

25 May '05

i did some searching in the mailman code and have discovered that mailman uses the VERBOSE flag to the python regular expression package, which means that unescaped spaces in the regular expression are ignored. so you need to change the topics to be like: CentOS\ 4\ i386 or: CentOS[ ]4[ ]i386 i'm not sure how many backslashes will be necessary to make it through to the module correctly, so brackets may be easier. or you could change the subject line format to be more like: CentOS-4-i386 so you could match without spaces.

1 0

Recompiling kernel
by kenkensmile＠netscape.net 25 May '05

25 May '05

Recompiling kernel Hi I am using CentOS 4 and trying to recompile kernel for my AMD Thunderbird 1.4 CPU. I used a manual for fedora 3,but I can not make it. After doing #installkernel 2.6-new arch/i386/boot/bzlmage System.map My comuter says "arch/i386/boot/bzlmage no such a file or directory" Could you possibly help me where the appropriate directory is please? Thank you for your help in advance. Cheers, Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

3 2

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

--- Chris Mauritz <chrism(a)imntv.com> wrote: > The original poster was after a 54mbit wifi card and so > far, all of the > recommendations have been for 11mbit cards. Not true, the WG511 that I recommended is a 54mbit card. > I'd also be > interested if > anyone has positive things to say about any readily > available 54mbit > wifi cards + CentOS/Linux. > > Cheers, > > C > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Michael 25 May '05

25 May '05

Greetings: I'm just installed Centos-4 on an IBM T-21 laptop. So far so good. Now I'd like to pop in a wireless lan adapter. I'm looking at a buying a Linksys WPC54G adapter (although I haven't done so yet). After doing some searching, it looks like the best way to get this card working is via ndiswrapper [http://ndiswrapper.sourceforge.net] and then to use Windoze drivers. So I downloaded ndiswrapper and during the install, I received a warning message referring to "4K Stacks" and that NOT disabling 4k stacks can cause some drivers to crash. The docs went on to suggest I recompile the kernel to disable CONFIG_4KSTACKS. Question: For really like to stick to the stock CentOS-4 kernel and not create/use a custom one. Has anyone had a problem using the Linksys WPC54G Cardbus adapter + Centos-4 and NOT had to use a custom kernel? For that matter, since I haven't purchased the card yet, can I get a recommendation or two about a workable wlan cardbus (g) adapter that could most likely be found at Best Buy/CompUSA/Fry's ? I'd like to be able to easily return the card if things don't work... I did some searching a decent card and it seems that a number of good wlan chipsets are discontinued or hard to find, so I'm slightly confused as to what to get. Thank you. Michael Chinn

2 1

RealPlayer on CentOS 4
by Hugh Tollan 25 May '05

25 May '05

Any ideas folks?? have installed RealPlayer10GOLD on CentOS 4, I have tried to uninstall it with the rpm -e command but I am being told it doesn't exist...when I try to download it again I am told that it is already installed! many thanks in advance _________________________________________________________________ Want to block unwanted pop-ups? Download the free MSN Toolbar now! http://toolbar.msn.co.uk/

4 4

Release date for 3.5
by User Lists 24 May '05

24 May '05

Hi all, Somebody knows when centos 3.5 will be released?? Thank you very much. _________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com

2 1

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > I still disable it though 'cause its a real pain.... Yes, because it's new, the defaults are immature, and the majority of both developers and system administrators don't know much about it. So disable it and let others deal with it if the want to. You have that choice. ;-> But by making it the standard in its EL4 line (including FC2+, with changes in FC3+ which RHEL4 inherited), it forces everyone to start learning it, start reporting good defaults, and get it adopted as a standard by everyone. Red Hat does this all-the-time, and doesn't blink when people start screaming about compatibility because it really only does it when it's really, really a necessary adoption. ;-> As I said before, one person I really feel for is Jorg. The guy is "on-the-ball" with POSIX developments, and reguarly gets chastized for breaking compatibility to do so -- especially when some implementations (e.g., GNU Tar) were non-standard in the first place! ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Ted Kaczmarek <tedkaz(a)optonline.net> > Thanks for the excellent post, no defense experience but dealing with > the street side for quite a while now. I've worked at banks where the developers put the same routines for "ATM withdrawl" in the same scope and access as the "back-end debits/credits." Their same attitude is, "oh, the system is secured by others." And when you don't give up, they are arguing, "oh, it'll push back the release date." Some go as far as talking to management to get an override. And then they _really_hate_you_ when you modify their code and show how easy it is to actually make sure software, or implement MACs at the system-level that do the same thing (but is incompatible with the software). In a nutshell, there are a lot of coders out there that believe their software and routines should access the entire system, no restrictions. Although UNIX is typically better than Windows, largely because Microsoft's application division still writes code for "Chicago" (including MS IE to date), there are still cases where I can't trust it. And I definitely need to make sure a compromise of one component is well outside the access and scope of a more critical item it uses. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Feizhou <feizhou(a)graffiti.net> > What is really needed is the ability to limit access to a file on a per > user account basis (acls), not by locking down via a group permission. And that's POSIX's ACLs, c/o the "Austin Group" work of the IEEE POSIX committee circa 2001 and the X/Open Single UNIX Specification (SUS) version 3. XFS on Linux has had POSIX ACL support since day one (using its own codebase), and it's largely XFS's GPL contributions (and direct port from Irix, unlike IBM who ported JFS from OS/2 and not AIX) to kernel 2.6 (POSIX ACL's were standardized as of the 2.5.3 development branch, thanx largely to SGI). Ext3 has had a varied history in the 2.4.x timeframe, and even Red Hat gave up on them in Red Hat Linux 8.0 until kernel 2.6 in FC2+. But even POSIX ACLs are _still_ Discretionary Access Controls (DAC), atop of the legacy UNIX DACs we're all used to. They just augment discretionary control, and don't solve the MAC problem. MAC limits you, not augments you with delegation, on purpose.. People tend to hate MAC when they are first presented with the conepts, because they expect them to work like DAC. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > As you have pointed out it restricts the security granularity of the > system, which in turn will lead to other "work arounds" to achieve > better granlarity and those work arounds will ultimately lead to > sloppiness, making Johns point very valid indeed. First off, SELinux is _optional_ on a system-wide basis. Secondly, SELinux does not have to affect various services, different distros are free to ship different defaults. Third, in typical Red Hat fashion, they adopt "new technologies with good practices/standards" all-the-time. We have to thank for forcing us back to the GNU C Libraries and an ANSI C++ compiler which has drastically improved run-time/binary compatibility. Lastly, Red Hat, like many others, actually stick to standards. I very much dislike when people complain about "compatibility issues" when all someone is trying to do is "get back to the standard" or "be compliant with the new, universal standard." E.g., several GNU projects -- from GCC 2.x's non-ANSI C++ implementation (and especially the entire, multi-yser GCC 2.9.x "beta" merge of GCC 2.x and EGCS) to GNU Tar through 1.13 -- were forks from standards. And when people finally forced the issue of standards compliance, they get chastized. Heck, one of the people I will always appreciate is Jorg, who has gotten reamed left and right on cdrtools, star, etc... He's probably one of the best Linux developers leading full POSIX 2001 compliance (adding all the new IEEE/SUS "Austin Group" developments in various programs). Now SELinux isn't a half-bad design by the NSA and others. Linux sorely needed MAC and, to a lesser extent, Role Based Access Controls (RBAC) as it's "legacy-only" UNIX access controls was not only falling behind NT, but even most proprietary UNIX flavors. But, again, it's _optional_. Turn if off if you wish, but I think it's about time a distro offered it, and attempted some secure defaults. It is not "sloppy" or "broken," just immature in application of defaults yet -- especially since both developers and sysadmins are not used to it being enabled. So how SELinux any different than any other shift-adoption in Red Hat's history? Now my background is largely in defense with several years in financial (which is, ironically, a major overlap in systems/network accounting, as well as crypto, etc...). And a lot of my job has been to go around and ensure developers and integrators are adhering to security standards. And I'm not just one of those "complainy" types either -- because I'm also a software engineer who regularly refutes the "I have to have root" or "we have to do this" non-sense right back in their own language. Especially when such cases are not really a security issue, but an engineering workflow issue in the first place. E.g., an software engineering development system -- even with run-time and/or target on the same system -- should _never_ be designed so the development, run-time and/or target have full control of the system. All should be sandboxed in different ways so it's very easy for the developer to tear down and rebuild the run-time/target from the development tools. If not, then the development environment is incomplete. I don't know how many times I've seen engineers (and I'm one of them too, so I know how they think) waste time fighting a system mis-configuration they introduced because their development, run-time and/or target environments are not finite and contained. They believe they need full root on the system when they don't. And damn do I hate it when the network admins get on my case because someone put a NIC in permisciuous mode -- the engineer shouldn't even be able to do that! With that said, the person who said that he's worked on Classified Networks and said MAC is not a requirement needs to be re-briefed. Access controls are _always_ implemented, and if a system is unable to conform to the required standard, there is a variance or other exception, and the risk must be mitigated _and_ an "effective enough" manual procedure implemented. I _explicitly_ used the term "accountable" because there are two types of Classified Information -- "non-accountable" (typically US DoD "Confidential" and most "Secret") and then their are "accountable" (various, higher classifications). You can typically get away with common variances and other exceptions with minimal, additional manual accounting for "non-accountable." But any automation helps. When it comes to "accountable," MAC/RBAC really helps a crapload -- and the NSA really "got the ball rolling" for Linux, which was really necessary. As far as financial networks, don't even get me started. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > > On Tue, 2005-05-24 at 08:08, Micha Silver wrote: > > > > > > The best thing to do is add this to /etc/selinux/config > > > > > > SELINUX=disabled > > > > > > And then get on with the real jobs.... > > > > > > > Listening to all the pros and cons of SELinux. > > I'd like to improve the security of our regional web server > using SELinux. > > We have a main regional web site and several virtual > domains, kept up by > > private users, all on the same server. Some of the private > users want to run > > php and database apps on their websites. Up till now I > steered away from > > allowing users to run anything on their sites, since a > breakin to any > > private virtual domain would endanger the whole http > process, including the > > main regional site. I'm preparing to switch over to a new (CentOS 4) > > machine, and I thought to set up a different SELinux > context for each > > virtual domain, so that a vulnerability in someones private > web site would > > be isolated and not be able to crash the other domains. > > Is this achievable *without* SELinux?? > > The simple-minded way has always been to run a separate http > instance bound to a different port or IP address, running as > a different user. If you only have one IP address and need > to appear to be on port 80, you can arrange this with a > virtualhost on the main server that uses proxypass or a > rewriterule that results in a proxy connection to the server > running under the other uid. > Thanks Les, With several virtual domains, setting each up on a separate port with rewrite rules, and running several httpd processes under different UIDs would quickly become not so "simple-minded" Regards, Micha > --- > Les Mikesell > lesmikesell(a)gmail.com > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos >

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > The best thing to do is add this to /etc/selinux/config > > SELINUX=disabled > > And then get on with the real jobs.... > Listening to all the pros and cons of SELinux. I'd like to improve the security of our regional web server using SELinux. We have a main regional web site and several virtual domains, kept up by private users, all on the same server. Some of the private users want to run php and database apps on their websites. Up till now I steered away from allowing users to run anything on their sites, since a breakin to any private virtual domain would endanger the whole http process, including the main regional site. I'm preparing to switch over to a new (CentOS 4) machine, and I thought to set up a different SELinux context for each virtual domain, so that a vulnerability in someones private web site would be isolated and not be able to crash the other domains. Is this achievable *without* SELinux?? Thanks, Micha

2 1

CentOS-announce Digest, Vol 3, Issue 13
by centos-announce-request＠centos.org 24 May '05

24 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:435 Important CentOS 3 ia64 mozilla - security update (Pasi Pirhonen) 2. CEEA-2005:434 Important CentOS 3 ia64 - centosplus firefox security update (Pasi Pirhonen) 3. CESA-2005:434 Important CentOS 4 i386 firefox - security update (Johnny Hughes) 4. CESA-2005:434 Important CentOS 4 x86_64 firefox - security update (Johnny Hughes) 5. CESA-2005:435 Important CentOS 4 i386 mozilla - security update (Johnny Hughes) 6. CESA-2005:435 Important CentOS 4 x86_64 mozilla - security update (Johnny Hughes) 7. CESA-2005:435 Important CentOS 3 s390(x) mozilla - security update (Pasi Pirhonen) 8. CESA-2005:435-01: Important CentOS 2 i386 mozilla security update (John Newbigin) 9. CEEA-2005:434 Important CentOS 3 s390(x) - centosplus firefox security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 May 2005 15:09:44 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:435 Important CentOS 3 ia64 mozilla - security update To: centos-announce(a)centos.org Message-ID: <20050523120944.GE1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2005:435 https://rhn.redhat.com/errata/RHSA-2005-435.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/mozilla-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-chat-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-dom-inspector-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-js-debugger-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-mail-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-devel-1.7.8-1.1.3.1.centos3.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Betr.: [CentOS] VPN
by Thom van der Boon 24 May '05

24 May '05

IF you are not stuck to IPSec, you might want to take a look at OpenVPN (www.openvpn.org) I found OpenVPN easier to install than FreeSWAN (an IPSEC VPN) and have setup an OpenVPN solution between my German office and our mainoffice in a matter of hours. Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> simone72(a)email.it 23.05.2005 18:18:56 >>> Hi list, I am trying to create a VPN between two different locations. On the first location we have a cisco pix 525 Natting the internal 192.168.100.x network, while on the second location we have a Centos3 box Natting via iptables the internal 192.168.10.x netowrk. My goal is to connect this 2 over the internet via IPsec. I created the IPsec Net2Net via the network configuration graphic tool, and I configured the cisco following the howto http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html . From my understanding, I should have an ipsec0 network device showing up, so that I could route all traffic from 192.168.10.x directed to 192.168.100.x through it. The thing is that when I try to ifup ipsec0 I get the following errors: modprobe: modprobe: Can't locate module ripemd160 modprobe: modprobe: Can't locate module cast128 modprobe: modprobe: Can't locate module lzs modprobe: modprobe: Can't locate module lzjh So, after googling and reading a lot with no success, I would like to ask for advice on this, and successfull story :). I really need to have this VPN running, and I am not tied to this one solution only, linux-to-linux VPN, openVPN or anything else you could suggest would be great. Thanks in advice Simone _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

5 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss