- Discuss - lists.centos.org

Re: Official CentOS CD/DVD Vendor Program
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

My $0.02 ... From: Chris Mauritz <chrism(a)imntv.com> > What's the point? Awareness, partnerships, retail notoriety and most of all, a starting point for now. You have to start somewhere. > I checked out linux cd mall. They charge $12.50 for the CD set (or DVD) > and CentOS makes ONE DOLLAR. Unless you envision tens of thousands > of people buying CDs, it hardly seems like a worthwhile endeavor I can envision that volume per year. > unless you're the CD distributor. The CD distributor has the economies-of-scale in the fact that they already have a built infrastructure, web front, relationships, etc... that CentOS can tap. For CentOS to build the same infrastructure, it would cost far more per unit sold -- at least at, again, "a starting point for now." > Why not just find a way to make it easier for people to donate directly > to the project instead of creating a needless middleman who is taking > 92% of the money for each CD/DVD set sold? Again, costs involved are relevative here. > Hell, for 92% of the profit, No, that's 92% of the _revenue_, and _not_ the "profit" (sometimes I think some Linux advocates need a refresher course in basic microeconomics ;-). There are more costs involved than just CD duplication here. > I'd be more than happy to sit at home and burn DVDs all day. And take orders? And handle shipping? And resolve issues with the site, customers, MC/VISA complaince on e-commerce, etc...? You can only do so much on your own before you need someone already doing it who can do it for much cheaper. > Where do I sign? 8-) You sign next to "I will learn how the infrastructure and operational costs of e-commerce works before I speak again." ;-> More seriously now, does everyone have to question everything around here? You don't think the management hasn't thought of these things? Why does everyone seem to believe they know better than the management who not only volunteers their time, but puts in the hours to be productive, including all the "less fun stuff" in the logistics and attention to detail? More pertinent, if you make posts like this, that are only include 5% of the actual details involved with doing such (and expose what can only be termed ignorance of the other 95%), how seriously do you think people can take your comments? I didn't. ;-ppp -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

insmod ip_conntrack_ftp
by Mickael Maddison 26 May '05

26 May '05

Hello CentOS, Is there a specific RPM that makes "insmod ip_conntrack_ftp" available? I've been using that on a number of servers fine, but the latest one I've built, running insmod ip_conntrack_ftp gives me: insmod: can't read 'ip_conntrack_ftp': No such file or directory -- Best regards, Mickael mailto:mike@kamloopsbc.com www.MickaelMaddison.com

3 3

Re: Demonizing generic Linux issues as Fedora Core-only issues -- why I hate these meta-discussions ...
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: "Bryan J. Smith <b.j.smith(a)ieee.org>" > You are indeed correct (I must have been looking at the RHEL3 dir**) First off, that's now 2 strikes for me. Small ones considering the context well outside of the points, but still it hurts my credibility. This is one of the things I hate about meta-discussions, at least how I approach them. Sometimes I just need to learn that it doesn't matter how many additional examples I give, some people aren't going to do anything but blame Red Hat. And by giving example after example, or attempting explain item after item, I'm going to eventually slip up from memory from time-to-time, which hurts my credibility -- regardless if the actual mistake was small given the context of the discussion. Sigh, there is a point where one should just resign and submit to the fact that if something doesn't work for someone, and { Microsoft, Red Hat, SuSE, even Debian as of late, etc... } is involved anywhere at all (even if it's a fork to another architecture -- e.g., anyone who has dealt with Cobalt/Sun releases, a primary reason for Red Hat's latter trademark enforcement ;-), the other person has no interest in understanding the "root" cause and will not see anyting to the contrary. My apologies for tying up the list with this non-sense. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: Demonizing generic Linux issues as Fedora Core-only issues -- MySQL 3 v. 4 linking licensing issues
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > RHEL-4 shipped with MySQL 4.1.x (and has a 3.23.58 client to work with > older databases) ... the latest SRPMS are mysql-4.1.10a-1.RHEL4.1.src.rpm > and mysqlclient10-3.23.58-4.RHEL4.1.src.rpm. You are indeed correct (I must have been looking at the RHEL3 dir**): ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4/en/os/i386/SRPMS/ Hmmm, that's actually a _major_ variance from Fedora Core 3: http://download.fedora.redhat.com/pub/fedora/linux/core/3/i386/os/Fedora/RP… [ **NOTE: I have not supported MySQL since the RHL9/RHEL3 series, hence why I didn't know it off-hand, just of the linking issues with version 4. ] Which begs the questions: 1) How much testing did it get in the Fedora Development/Core series? 2) How did they solve some of the linking issues I've heard about? As I mentioned before, the current Fedora Core 4 Test has it too, so I have to assume one of the following: A) Red Hat negotiated a license to redistribute as built as before but now for MySQL 4 (not likely since even FC4 has it now, unless the license also applies there, but I doubt it based on how Red Hat makes sure any FC/FE packages are always 100% redistributable by others) B) Red Hat shifted away from the few static links that it has previously used (more likely?) C) The packages causing the linking licensing issues have change their licensing? (NuSphere possibly?) D) MySQL AB changed its stance on linking in MySQL 4 as of v4.1? Anyone know the answer? I have to go back and research why Red Hat stuck with 3.23 and see how they are now redistributing 4.1x? > CentOS-4 has the identical programs {as with all other items except > LOGOS, trademarked text, and yum and where updates are done} in it's > base :) Which is why I love it. I must have just looked at the wrong directory. I'm also very disturbed that Red Hat would not give the public time to test in the leading community releases. If I had to speculate, I'd say it's because it was already testing in most other distros, but I'll have to read up in Bugzilla on why the change was made (as well as what allowed Red Hat to change it's stance on MySQL 4 in the first place). -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

CentOS-announce Digest, Vol 3, Issue 15
by centos-announce-request＠centos.org 26 May '05

26 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:413 Important CentOS 3 i386 ImageMagick - security update (Tru Huynh) 2. CESA-2005:413 Important CentOS 3 x86_64 ImageMagick - security update (Tru Huynh) 3. CESA-2005:472 Important CentOS 3 i386 kernel - security update (Tru Huynh) 4. CESA-2005:472 Important CentOS 3 x86_64 kernel - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 May 2005 00:46:09 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2005:413 Important CentOS 3 i386 ImageMagick - security update To: centos-announce(a)centos.org Message-ID: <20050525224609.GA30869(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:413 ImageMagick security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2005-413.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/ImageMagick-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-c++-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-c++-devel-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-devel-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-perl-5.5.6-14.i386.rpm source: updates/SRPMS/ImageMagick-5.5.6-14.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update ImageMagick\* Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Re: Betr.: [CentOS] VPN
by Peter Farrow 26 May '05

26 May '05

Hi there, yes it was with a Nortel contivity on a few occassions and the other times with a Cisco pix. interstingly enough the Cisco VPNs often required updates to the IOS to make them 3Des compliant, As its late here in the UK (past midnight GMT+1) here is a very quick and dirty freeswan guide. Needless to say the things that cause the biggest headache for most users is the use of RSA keys and opportunistic encryption. Since this is NOT what 99.9% of the masses need or want then there is a quick and simple and just as secure alternative setup, but its not that well documented. Opportunistic encryption came in versions 2 and above of freeswan by default, this has the effect of clobbering the network default route and replacing it down the ipsec interface (what you want if you want to encrypt everything, but not really any great use in the real world). Most people want to do site <-> site vpns and these are best achieved without opportunistic encryption and by the use of preshared keys. 1)Make sure you get a version of freeswan suitable for your kernel, if you can't find one go to somewhere like rpms.pbone.net and find a kernel for which there is a freeswan version. Many people try and hunt a freeswan version to match their kernel, I do it the otherway round, find the latest freeswan compatible kernel you can for your architecture, you can always compile it from source but why my life harder for yourself. 2)get the freeswan module for the kernel you found, and the same freeswan-userland version as well. then proceed as follows: after you have installed the [from rpm] Typically to kill opportunistic encryption add these lines to your ipsec.conf file: after the config setup section near the top, conn block auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn clear auto=ignore conn packetdefault auto=ignore Doing this stops all the crap you get when ipsec starts and then kicks you off the system about 60 seconds later if you're connected remotely as this kills the opportunistic setup feature. Do the same at the other end as well. Then start the service. Then add a section for each tunnel you want to set up. if you have multiple subnets at each site which can't be encapsulated in a single subnet declaration, you will need to add a new tunnel defintion for each. Here is an example : conn site1-site2 #this is the connection name [tunnel] identifier left=21.21.100.10 #This is the ip address of the first linux box leftnexthop=21.21.100.9 #This is usually set to the defualt gateway for the first linux box leftsubnet=10.11.2.0/24 #This is the LAN subnet behind the first linux box right=21.21.100.178 #This is the IP address of the second linux box at the other end of the tunnel rightsubnet=10.11.4.0/24 #This is the LAN subnet behind the second linux box rightnexthop=21.21.100.177 #This is the IP address of the default gateway setting of the other linux box authby=secret #We are going to use a "password" or secret to encrypt/auth the link pfs=no #Turn off perfect forward security, this makes it faster and easier but less secure auto=add #Authorise but don't start esp=3des-md5-96 #encapsulating security payload setting, encryption used for auth and data Now cut and paste this and add it to the ipsec.conf file on the second machine completely as is, unmodified. Then in you /etc/ipsec.secrets file on each machine you will need to add a password [secret] for each each of the tunnels you have specified, in the above example we would have: 21.21.100.10 21.21.100.178 : PSK "a-passwordin-here-with-the-quotes" Add this to the very top of the ipsec secrets file, one entry for each pair of machines in this format leftmachineip rightmachineip : PSK "password" Then do a service ipsec restart on each machine, bring the link up with this command, it only needs to be invoked from either one of the ends ipsec auto --up site1-site2 You should get output like this if you did it right: ipsec auto --up site1-site2 104 "site1-site2" #2086: STATE_MAIN_I1: initiate 106 "site1-site2" #2086: STATE_MAIN_I2: sent MI2, expecting MR2 108 "site1-site2" #2086: STATE_MAIN_I3: sent MI3, expecting MR3 004 "site1-site2" #2086: STATE_MAIN_I4: ISAKMP SA established 112 "site1-site2" #2087: STATE_QUICK_I1: initiate 004 "site1-site2" #2087: STATE_QUICK_I2: sent QI2, IPsec SA established Remember you will need to allow the ipsec interface in your firewall and you will need to add lines like this: # Accept udp connections to port 500 for ipsec $IPTABLES -A INPUT -p udp --sport 500 --dport 500 -j ACCEPT $IPTABLES -A OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT This is just about the quickest way to set up a VPN tunnel with Freeswan, it takes minutes. If you want to make if more secure, you can tune the config once you get it running this way! Remember the only machines that can't see the full extent of the other LAN network are the linux boxes creating the tunnel. So the left linux box will not be able to ping stuff on 10.11.4.0/24 network and the right linux box will not be able to ping stuff on 10.11.2.0/24 network - don't forget this.... its commonly mistaken by some to mean the tunnel isn't working, to truly test it end to end you need hosts on the LANs at each end to ping each other. If you want to make it work through NATing gateways you will need to port forward the udp 500 setting above on your firewall. Enjoy! Pete Kennedy Clark wrote: >Any chance of getting a quick HOW-TO posted to the group for that? >;-) Sounds interesting. > >I saw your post about using it with Cisco & Nortel equipment -- I work >with both a lot at my current customer. What types of equipment have >you used it with from both vendors (e.g., Cisco: IOS, PIX, VPN3K; >Nortel = Contivity)? > >Thanks!! >Kennedy > >

3 13

Re: [CentOS-announce] CESA-2005:472 Important CentOS 3 i386 kernel - security update
by John Newbigin 26 May '05

26 May '05

The yum headers for these updates seem to be incomplete or out of date... perhaps only for non i686 arch. 0:kernel-source-2.4.21-32.EL.i386=RPMS/kernel-source-2.4.21-32.EL.i386.rpm Tru Huynh wrote: > CentOS Errata and Security Advisory 2005:472 > > kernel security update for CentOS 3 i386: > https://rhn.redhat.com/errata/RHSA-2005-472.html > > The following updated file has been uploaded and is currently syncing to > the mirrors: > > i386: > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.i586.rpm > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-BOOT-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-doc-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-hugemem-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-hugemem-unsupported-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-smp-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-smp-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-smp-unsupported-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-smp-unsupported-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-source-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.i586.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.i686.rpm > > source: > updates/SRPMS/kernel-2.4.21-32.0.1.EL.src.rpm > > You may update your CentOS-3 i386 installations by running the command: > > yum update kernel\* > > Tru > > > ------------------------------------------------------------------------ > > _______________________________________________ > CentOS-announce mailing list > CentOS-announce(a)centos.org > http://lists.centos.org/mailman/listinfo/centos-announce -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin

1 0

Re: [CentOS] Re: Centos and SAMBA
by Robert Moskowitz 26 May '05

26 May '05

At 05:14 PM 5/25/2005, Bryan J. Smith <b.j.smith(a)ieee.org> wrote: >From: Robert Moskowitz <rgm(a)htt-consult.com> > > I meant what is Centos equiv to in terms of Fedora. > > As the scripts I am using are set up for core 4. > >Fedora Core 4 isn't even out yet. Test 3 just hit the other week. I do not know where I got that core 4. My blunder. Barrs Law of Recursive futility If you're smart enough to use one of these.... .....you can probably manage without one!

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > Yes, but... whose choice was it to ship 2.6 with lots of broken > and omitted stuff when 2.4 works better for many things? Again, 2-2-2, 6-6-6 At some point, Red Hat has to start the new series for "early adopters." That means being the first to adopt the new GLibC, GCC, kernel, etc... Looking at just the GLibC 2+ generations (post-LibC4/5)... EL0 series: GLibC 2.0, GCC 2.8.1.1, kernel 2.0 EL1 series: GLibC 2.1, GCC 2.91.66 (EGCS 1.1.2), kernel 2.2 EL2 series: GLibC 2.2, GCC 2.96, kernel 2.4 EL3 series: GLibC 2.3, GCC 3.2, kernel 2.4 EL4 series: GLibC 2.4, GCC 3.4, kernel 2.6 In each 2-4 "Community Linux" revisions of those "Enterprise Linux" series, Red Hat minimizes changes. Typically the .0 can go through a number of refinements from .0 to .1, but then they taper off in preparation for the .2 and 18 month EL series. But even what I call CL4.0 (Fedora Core 2) wasn't nearly as much of a shift as CL0.0 (Red Hat Linux 5.0), and still a bit better than CL2.0 (Red Hat Linux 7[.0]). One of my only complaint starting with Red Hat Linux 9 (_well_before_ Fedora Core) is the lack of revisions to warn us of ".0" like shifts. > Just because a developer writes some code and tacks on a higher > version number doesn't mean it's ready for prime time. Correct. I never said so and I have been _very_critical_ of Red Hat no longer using revisions to tell us that its either a major shift (.0) or an evolutionary update (.1, .2, etc...). And this was _before_ evne Fedora Core. Red Hat should have called Red Hat Linux 9 as Red Hat Linux 8.1. Yes, they added NTPL, but there have always been a few changes from a .0 to a .1 as things are more finalized. Every .0 revision has made some poor considerations in a few regards, and after the "early adopters" start using it, they are exposed. The reality is that most things are _not_ exposed _until_ people actually start using things. Even Red Hat Linux 7[.0] was regression tested to the anal power with GCC 2.96 and its ANSI C++ requirement, and it wasn't until after Red Hat released it that the projects that weren't writing ANSI C++ compliant software took note. People like to throw up the fact that Red Hat included GCC 2.91.66 (EGCS 1.1.2) for kernel building and that's why they should have gone with GCC 2.96, but I will return point out that many distros were shipping GCC 2.95 as well, and GCC 2.95 had a lot of issues with various software too. > Well, an occasional rant is therapeutic - or at least cheaper than > smashing the equipment that no longer works after you upgrade the > software. Constructive rants are good. They identify real technical issues. But "brand name" rants are typically full of ignorance, blaming companies for things outside their control, or outside their focus (e.g., features on a SLA-centric distro). Again, I think it's good to see projects like CentOS, but that doesn't mean you have to complain about Red Hat on things that are not Red Hat's doing or focus. The principles of configuration management are universal, and one must be wary of any new version, regardless of where it comes from. In the past, Red Hat made this very easy with revisions. With RHL9+, I think Red Hat really needs to bring them back. > I'm questioning the sensibility of shipping a kernel in what should be > an upgrade If Red Hat doesn't do it, another distro will. And then that distro can be chastized by people like yourself instead of Red Hat, and Red Hat will benefit from being on the trail that other distro's issues. I purposely kept my CL3.2 (Fedora Core 1) systems well after CL4.0 (Fedora Core 2) came out, and didn't upgrade until CL4.1 (Fedora Core 3) was released. I did the same of CL2.3 (Red Hat Linux 7.3) until CL3.1 (Red Hat Linux 9) came out, CL1.2 (Red Hat Linux 6.2) until CL2.1 (Red Hat Linux 7.1), etc... It's best to wait on a new distro series until 1 year after it first starts development, typically 6 months after it's first revision's release. Fedora Core 2 was _very_stable_, but it was _very_incompatible_ with many things because of its changes. Those compatibility issues will _not_ get resolved until someone finally releases an "early adopter" release and people then start throwing things at it. Heck, even SuSE does this too. And SuSE even came out with their Linux 2.6-based enterprise distro much sooner than Red Hat. So you could easily "double" your chastizing of Red Hat towards SuSE in the same regard. At some point, Red Hat has to "give up" further development on Linux 2.4, or anything else, and "move on." There's nothing stopping you from delaying your adoption for 6+ months, or even 36+ months (in the case of RHEL/CentOS). I've had this argument over and over with people -- not just Linux. You can't always blame vendors for your own professional negligence. Sometimes vendors just ship what consumers want, even when they tell them "we don't recommend this." A perfect example was Windows 95/98/Me -- something I _never_ allowed on my networks (only Windows NT 3.1, 3.50, 3.51, 4.0 and 2000). And that means you don't just go off and upgrade when the vendors says "we've changed all the core stuff" which is a definite sign that things might break. Your option is always that you can stick with the older release. Again, 6+ months for Fedora Core today, 36+ months for RHEL/ CentOS. > with many things that don't work at all that worked in > the previous version. Of course not! That's what change does! ;-> Red Hat release 2-4 revisions every 6 months before changing things up. SuSE does much of the same as well, and more distros are moving to this model too. Things break, but the idea is to maintain 2-4 revisions over 12-24 months that don't. In the case of Red Hat and SuSE, they also release a distro every 18 months based on the "most mature" revision and then support that for 60+ months under a subscription model. Otherwise, the overwhelming distros don't do such a good job, and _any_ release of theirs can dork up anything! I'd really like to find a vendor who balances "early adoption" with "anal SLA-level reliably" so well and for so long. It's the 2-2-2, 6-6-6 model that everyone, even Novell-SuSE, have adopted. > As you point out, these aren't surprises. > While I hate to complain about free software, I think that user's > experiences are relevant and should be reported even if they are > painful. That's fine, if you report them. But then people go beyond that and start "analyzing." And when I say "analyzing" I mean they "blame the vendor." And the illogic doesn't stop there -- they will blame Red Hat for issues with CentOS, or not realize that Red Hat really did take time, effort and extensive consideration to get it to work, and couldn't. And not only that, but when other distros ran into the same issues. > I'm not sure I believe that in the case of CIPE, since the 1.6 version > specifically addresses the changes in the 2.6 kernel and was available > well before FC3 or RHEL4 releases which did not include it again. Both FC3 and RHEL3 started with FC2. And FC2 has already been through 6 months of development and Fedora Core 3 was already entering into Test by the time CIPE 1.6 was finally available. And even then there were issues -- let alone issues with security and the lack of interest. At some point Red Hat crosses a threshhold where they have to say it's too close to release date. There's just not enough time to not only integrate the package, but give its "due dilligence" in package test (Rawhide/Development), distro regression test (Beta/Test) and post-release resolution. And when a package doesn't get modified to support kernel 2.6 until some 9 months after kernel 2.6 release, and still has issues, at some point, Red Hat's gotta say "this is going to cause us headaches to support." > If I were to speculate about intentions as you suggest above, I'd > guess that someone at RedHat read the one negative review published > about CIPE, decided it was no longer a selling point, and walked away > from the integration they had done before. And I'd say you haven't looked through Bugzilla. I don't know how many times I've seen people complain about Red Hat and then a few of them actually take the time to submit Bugzilla reports and then realize what happens. The few that do then change their tune. Any and every major decision on EL begins with their development of CL. And that has not varied in Fedora Core since the days of Red Hat Linux 4.0 on-ward. If you want to see something change, you have to get involved. And that means taking the time to understand what you _can_ do to see things change. It's very easy in the Red Hat Linux world. And its even easier now that Fedora Core is no longer the "product" that Red Hat Linux is, even though Red Hat Enterprise Linux has a 1:1 package relationship just like Red Hat Linux prior. > But of course I wouldn't speculate about something like that... You don't need to. Hit Bugzilla. There are people who like to complain from ignorance. And then there are people who like to complain from familiarity. I typically choose to be the latter, although I'm sure I've done the former more than once too. > It's a complicated system, and it isn't immediately obvious that other > distros have exactly the same problems. Do you know how many times I hear people say that? And I just have to shake my head because it can't be categorized as anything else but ignorance? Do you know how many times I hear someone call something a "Fedora Core 2-only issue" yet it plagues SuSE Linux 9.1, even SuSE Linux Enterprise Server (SLES) 9 and Mandrake 10.x as well? And they will actually sit there and say "it's only a Fedora Core 2 issue" no matter how many times I send them links? Red Hat has its model and it is extremely effective. But it also means that you have to understand why the "end" of 2-2-2 and 6-6-6 is more "reliable" than the "beginning." Fedora Core 2 was the beginning. Red Hat Enterprise Linux 4 was the end. At some point, if you keep introducing latest'n greatest that still have compatibility issues, you are going to affect the quality of the end. > If you follow www.distrowatch.com for a few months you'll see that they > each keep trying to improve things in different ways. Yes, and the overwhelming majority of distros on distrowatch.com don't have a good release model, and they break all sorts of things everytime they come out with a new version -- at least in comparison to Red Hat or SuSE. > Switching distros should always be an option - that's one of the > big reasons for using open source. But sometimes people switch distros out of "brand name blame" instead of actual "technical focus." I don't know how many times I've seen people argue over 2 distros that use the _exact_same_ base! I've literally had people argue to death that APT is Deb-centric, and the RPM world doesn't have anything equivalent. And sometimes I think people aren't "up-to-date" on different distros because they used one from years ago, and their preference more currently. As someone who deploys Debian, Fedora, Gentoo, SuSE and RHEL and SLES regularly, there's a lot of overlap. > But, in spite of what I consider an occasional bad choice, Like CIPE I assume? At what point are you going to recognize that CIPE was really "no choice" until Fedora Core 3 was in Test? > Fedora/RH seem to be among the best and I do give the fact that > they've been responsible for getting buggy software in front of a > vast number of people credit for it eventually being fixed. "Buggy"? Or "incompatible?" Big difference! If GNU Tar is incompatible with POSIX, and someone introduces a new version or replacement program, like Star, that is, do you know how much the "ignorant majority" absolutely derail that person? Or when LibC5 is not getting the attention it needs, has security issues, yet GLibC2 is active, solves a lot of security and compatibility issues, etc...? Or when lack of ANSI C++ compliance hurts compatibility with future code, and GCC 3 is being finally pushed? Or when the fact that GCC 2.95 was adopted by many distros even when the GCC team said they should not and stick with GCC 2.91.66 (EGCS 1.1.2) which is proven (and the kernel uses)? > If you remember the state of free software before RH 4.0 was > released you will know what I mean. I do sometimes wonder > how things would have turned out if someone had built an equally > easy to install CD based on freebsd first, though. Who says it isn't and I don't also deploy FreeBSD and NetBSD? [ If you own the book "Samba Unleashed," you might open up the Appendix on BSD UNIX and see someone's name you recognize. ;-] > Hmmm, just who would you blame for WindowsME? Oh, that was Microsoft. Although oeople professionally negligent enough to ever allow _any_ "Chicago" release on their network were the start of the issue. Windows Me was Microsoft's attempt to get their own application developers to stop using "Chicago" interfaces. The result was that they created a release that was both incompatible and unreliable. As I always said about Windows, you had your choice between incompatible (NT) and unreliable ("Chicago"). I choose the former, and I was in the minority. But I didn't have 98% of the problems other people had. > Who would you blame for the upgrade that made interfaces not > start if the hardware address in the configs didn't match > the NIC? That was bad news for my remote machines where all > the drives had been cloned and the IP addresses set before > shipping. I'd blame you because you cloned, not installed. ;-> You can't blame Red Hat for an install approach they don't test for. [ BTW, Ethernet hardware addresses are used in IPv6. ] > I'm not positive about this, but I think it happened > at about the same time across Fedora/RH/Centos updates instead > of following the scenario you mentioned for testing things that > are supposed to change behavior. What version? I can tell you exactly if it was a major or minor change. .0 always changes stuff. Sometimes .1 changes a few things that didn't make it or needed to be addressed. .2 rarely does, as well as the "enterprise" release. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Betr.: [CentOS] Centos and SAMBA
by Thom van der Boon 25 May '05

25 May '05

Hi, I've setup a SAMBA PDC on Centos 4 last weekend and migrated my NT4 PDC (Users, Groups, etc) to the new Centos Server in a matter of a couple of hours. I've used the scripts and howto from: http://samba.idealx.org/smbldap-howto.en.html#htoc89 Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> rgm(a)htt-consult.com 25.05.2005 20:03:41 >>> Is anyone here doing real use of SAMBA as an NT domain controller? I have been attempting to follow: http://web.vcs.u52.k12.me.us/linux/smbldap/ Which is set up to work with Fedora core 4 (how is this equiv to centos 4?) It looks like I am rather far along. Hit my first obvious problem with the IMC populate script. It would be nice to have a centos version of all this.... _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Re: Centos and SAMBA
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Robert Moskowitz <rgm(a)htt-consult.com> > I meant what is Centos equiv to in terms of Fedora. > As the scripts I am using are set up for core 4. Fedora Core 4 isn't even out yet. Test 3 just hit the other week. I've been calling it the first version (.0) of a new EL5 series (CL5.0) because it switches to GCC 4.0. I haven't looked at it deep enough to see if other things have changed, but it's safe to say at this point, with RHEL4 out, Red Hat is looking to "shake things up" so don't expect FC4 to have the same compatibility as FC2-FC3-RHEL4. [ BTW, I caught a typo in my EL0-EL4 reference I posted before. Both EL3 and EL4 use GLibC 2.3, as does this new EL5. ] -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Centos and SAMBA
by Robert Moskowitz 25 May '05

25 May '05

Is anyone here doing real use of SAMBA as an NT domain controller? I have been attempting to follow: http://web.vcs.u52.k12.me.us/linux/smbldap/ Which is set up to work with Fedora core 4 (how is this equiv to centos 4?) It looks like I am rather far along. Hit my first obvious problem with the IMC populate script. It would be nice to have a centos version of all this....

2 2

Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > I'm still wondering about that... If anyone except Linus himself > even suggested that changing kernel interfaces in a way that would > break device drivers was a good thing, I can't imagine the reaction. > I could see that the changes through 2.4 were improving things, but > is there anything that is measurably better in 2.6 (at least compared > to the RH-patched 2.4)? I've been too busy trying to make some > firewire drives work as well as they did on FC1 to notice any other > changes. Agreed. But even Red Hat stands on the shoulders of Linus and the kernel developers. No matter how many people Red Hat puts on the kernel, there are still things outside of Red Hat's control. If you don't like what does or doesn't go into RHEL/CentOS, then you need to get involved with Fedora Core and make a case of what should. And one way to do that is to donate time. Because if it's not proven in Fedora Core to Red Hat's tastes, it doesn't go into RHEL/CentOS. So the most effective way you can influence RHEL, and therefore CentOS, is to get involved with Fedora Core. Red Hat is _not_ going to "force" something that it can't get to work with Fedora Core into RHEL arbitrarily. So if you don't see something in RHEL/CentOS as standard, you need to see why it didn't make it into Fedora Core. Once again, I will remind people that several people here _are_ indeed complaining about what doesn't come with RHEL, and not aware that it _does_: A) Not work in Fedora Core, and failure after failure keeps it out B) And is, subsequently, not going into RHEL where SLAs are involved C) Does _not_ come with pretty much _all_ other, similar distros Red Hat Enterprise Linux, like SuSE Linux Enterprise Server, are _not_ about features. Both 18 month releases are subsets of their 6 month revisions (even locales not supported in SLA are often removed). You are not paying for R&D and inclusion in the "Enterprise" flavor (although the funds _do_ pay for extensive GPL development, R&D and other integration attempts in Fedora Core and SuSE Linux). > Or with the logic of asking customers to pay extra to get something with > features removed... Again, the people who actually _pay_ for RHEL/SLES are _not_ paying for features. ;-> You are complaining about CentOS not coming with things standard, and then assinging blame for that to Red Hat, because you believe they are supposedly paid and should have more features. I can only label this as "ignorance" of how RHEL (as well as SLES) is developed, because anyone can go out to Bugzilla and see the detail of why something is not included. If you want the most features, then Fedora Core + { FE+Lorg, DAG, etc...} is your baby, maybe CentOS + additives if you don't mind waiting a year later. I think it's great that CentOS is trying to be the best of both worlds: SLA- quality with added features. But it really is "demonizing" when all I see is people making complaint after complaint about RHEL not having something when many, many, _many_ Fedora Development manhours were made trying to get exactly what you wanted working. At some point Red Hat has to say "this doesn't work, even if it works in 2-3 months, it still won't have time to 'bake' in usage, so we're dropping it from consideration for this version of RHEL." > I haven't seen anyone demonizing RedHat here. I see some people > reporting painful experiences, But people are going beyond reporting painful experiences. They are making conclusions and get "upset" when I give the technical details of why something wasn't included. If you care enough to want something I assume people are open enough to understand why it wasn't included. Microsoft is the company that doesn't do something unless their is at least 250,000 users. Red Hat, SuSE and others often try to do everything they can, even for maybe only 1,000 users, in their 6 month revisions. But at some point, if something really doesn't work, has security issues and just isn't something they want to stake their time and money on in a SLA (which can get _very_expensive_ for software company), they have to drop it. After all, after a thousand man-hours of attempted integration for even their Fedora Core release, are they really going to sign themselves up for yet another thousand-plus hours and nagging re-fix after re-fix when maybe only a couple hundred licenses of RHEL are actually going to hold them to it? Just remember what CentOS is based on, and how much work not only goes into that, but into making sure the distro works as advertised because SLAs are involved and that can get really costly for Red Hat if it ships something that is not well tested. Especially if only a few companies want it. > but I don't think anyone expects perfection and the best thing is to > learn from them. If people here should understand one thing from the Windows world, it is that features and quality can be mutually exclusive -- especially the farther you move away from the economies of scale. I just find it humorous that several people who use CentOS, a free redistribution of RHEL (where Red Hat doesn't see a dime), are not complaining about Linus & co. for the kernel, not complaining about the CIPE team and their lack of movement on kernel 2.6, not volunteering to even look at the Bugzilla reports to find out what issues were blantantly repeatable, let alone other distros that have the same issues ... But blaming solely Red Hat for this issue (and this is just one example). But I expect that because some people just blame Microsoft for things outside of their control too. Sometimes the only person to blame is the lack of interest by anyone. If that isn't ignorance, I don't know what is. -- Bryan J. Smith mailto:b.j.smith@ieee.org

3 2

OSS install problem
by Adrian Coman 25 May '05

25 May '05

Hi, I want to install the commercial version of OSS and test if Skype works better with it. The problem is that after I compile 2.6.9-5.0.5.EL without sound support and then install oss3992d-linux-x86-v26-regparm and make it start at boot, at boot time OSS fails because it can not find /dev/dsp /dev/mixer and some other /dev sound devices. Indeed they do not exist. What do I need to do? Did I do something wrong or I have to manually add the /dev sound devices? Thanks, Adrian

2 3

CORRECTION: I must modify/clarify my statement about .0 releases ...
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

In looking through Red Hat's FTP site, I can find no such statement with regards to "do not use on production servers" in any README or Release Notes of Hurricane, Hedwig, Guinness or Psyche (Red Hat Linux 5.0, 6.0, 7 and 8.0, respectively). What I have found in my archives is a cutting from the official Red Hat Network (RHN) announcement of Psyche (8.0) that says two things: 1) It is an "early adopter" release, and 2) Do not upgrade "production systems" from Red Hat Linux 7.3 I cannot find the full version of it on-line. I know I do have an archived copy of at least the full Guinness and Psyche release announcements from the RHN and will search for them in my archives tonight. I kept _all_ official RHN messages, although I fear they are in an archive at a former employer that I do not have a copy of. It very much bothers me that I cannot find the same in at least the "Release Notes" of Guinesse or Psyche because I could have swore I saw them on CD #1 in one of my sets (and not a Rawhide or Beta release). If anyone has the original Guinness or Psyche announcements from their RHN subscriptions, please send them to me off-line. I'd like to confirm I'm not going senile after all, although some would love to have proof of that. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > We would not build and distribute either of these things if they were > not released via the GPL. The RPMS/SRPMS that we are distributing are > indeed GPL. We firmly agree with RedHat on this issue (that only GPL > things should be distributed). The problem is that many distros are statically building MySQL 4 with some non-GPL components. Some of the terms/definitions on static v. dynamic building changed from MySQL 3 to MySQL 4. I'll look into some of the latest Fedora Development and see if they are approaching such now. But one thing Red Hat seems to be doing is avoiding a lot of the MySQL 4 developments because of MySQL AB's changes. > CentOS will also not include in our repos anything that is not allowed > to be re-distributed due to patents or US DMCA. And I've noted that. I said that's why I don't use "pure" Fedora (Core, Extras) or Debian-bases (both RHEL and CentOS fall into that as well), and avoid both Livna.ORG and DAG in a commercial environment. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Mini-centOS
by kenkensmile＠netscape.net 25 May '05

25 May '05

I am using centOS for my server and centOS is extremely stable. I almost love centOS more than my wife. However, centOS is a bit heavy to run on my notebook (P III 1G, 256MB RAM). I need gnome, firefox, openoffice, realplayer, gaim, acrobat and thunderbird on my notebook, but if I install all of them (plus base-system), my notebook becomes very slow. I wish I could have a lighter version of centOS for notebooks and old desktops. Is there any project that I could have a mini-centOS in the future??? Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

8 8

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

Michael: I can recommend the Netgear WG511. This one has a prism chipset; ndiswrapper is NOT required! Outpost.com sells the WG511 so you can probably find it at Fry's as well for around $45. Note: I do not recommend the WG511T which is a different chipset!. --- Michael <addymin(a)pacbell.net> wrote: > Greetings: > > I'm just installed Centos-4 on an IBM T-21 laptop. So > far so good. Now > I'd like to pop in a wireless lan adapter. I'm looking > at a buying a > Linksys WPC54G adapter (although I haven't done so yet). > > After doing some searching, it looks like the best way to > get this card > working is via ndiswrapper > [http://ndiswrapper.sourceforge.net] and then > to use Windoze drivers. > > So I downloaded ndiswrapper and during the install, I > received a warning > message referring to "4K Stacks" and that NOT disabling > 4k stacks can > cause some drivers to crash. The docs went on to suggest > I recompile the > kernel to disable CONFIG_4KSTACKS. > > Question: For really like to stick to the stock CentOS-4 > kernel and not > create/use a custom one. Has anyone had a problem using > the Linksys > WPC54G Cardbus adapter + Centos-4 and NOT had to use a > custom kernel? > > For that matter, since I haven't purchased the card yet, > can I get a > recommendation or two about a workable wlan cardbus (g) > adapter that > could most likely be found at Best Buy/CompUSA/Fry's ? > I'd like to be > able to easily return the card if things don't work... > > I did some searching a decent card and it seems that a > number of good > wlan chipsets are discontinued or hard to find, so I'm > slightly confused > as to what to get. > > Thank you. > Michael Chinn > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > This is not really true. We will probably never have everything that FC > has as added features ... but CentOS-4 has several added features and we > have been out for only a 3 months (so, not required to wait a year). Oh, sorry, I should have clarified. What I meant by "wait a year" was the time from the first .0 or .1 Fedora Core releases that a new version of RHEL/CentOS is based on. E.g., FC2 came out in May 2004, FC3 in November 2004. RHEL/CentOS 4 didn't follow until 2005. > We even have some features (mysql compiled postfix, NX/freeNX, > and soon MySQL-Administrator / MySQL-Query Builder) that are not > yet part of FC or FC Extras at all. Actually, some of this stuff will _never_ be included in FC/RHEL because of licensing issues with the fact that MySQL is GPL. This is well documented in a lot of places. Red Hat is the only distributor (although I haven't checked Debian) fully honoring the terms MySQL AB sets on its GPL releases of MySQL 4, which include not building and redistributing certain items. It's one of those things that Red Hat also gets chastized on, and one of the reasons I don't use DAG (or Livna.ORG) at businesses. Anything that has GPL licensing/mixing issues, "only for non-profit use" or otherwise is "questionable" use of patents is the reason why I stick with "pure" Fedora Core+Extras or Debian. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

CentOS4, KDE3.3 and 128 WEP
by John Logsdon 25 May '05

25 May '05

CentOS4 standard installation. I see that KwifiManager doesn't support 128 bit WEP which I need for other machines on the network, which is a bit of a blow - and rather surprising really as security should be quite a consideration on an enterprise level system (NB RH!). Is there a workaround? An alternative way of configuring my Belkin F5D6020 ver 2 card? eg a cvs download that I can get and copy via a stick? Or how to do it manually? I have tried regressing kdenetwork but that doesn't include kwifimanager at all. Ideas? TIA John John Logsdon "Try to make things as simple Quantex Research Ltd, Manchester UK as possible but not simpler" j.logsdon(a)quantex-research.com a.einstein(a)relativity.org +44(0)161 445 4951/G:+44(0)7717758675 www.quantex-research.com

3 9

file compatibility issue
by William Warren 25 May '05

25 May '05

I am trying to run a binary but the binary was complied on debian so the system throws me this error: libstdc++-libc6.2-2.so.3 This is Centos-4. How can i get that compatibility fixed? -- Computer House Calls, Networks, Security, Web Design: http://www.emmanuelcomputerconsulting.com What businesses are in Brunswick, Maryland? Check Brunswick First! http://www.checkbrunswickfirst.com My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD. -- carpe ductum -- "Grab the tape" CDTT (Certified Duct Tape Technician) Linux user #322099 Machines: 206822 256638 276825 http://counter.li.org/

4 12

iptables logging
by Peter Farrow 25 May '05

25 May '05

Hi All, A few years ago I was asked if I could redirect console messages from Iptables to a different virtual console, on RedHat 7.3 . I managed to do it, but can't remember how I did it, now that the same question has arisen ona Centos 3.4 box. I edited /etc/syslog.conf and redirected kern.* to /dev/tty2 for example & this didn't work I edited /etc/sysconfig/syslog and modified klogd options with -f /dev/tty2 & this didn't work either So I stopped syslogd and klogd altogether and iptables still logs to the current console (which ever one you're on). So my question is, how do I get iptables to redirect its output to another console? P. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

4 6

CentOS and HP Drivers
by Mark A. Lewis 25 May '05

25 May '05

I am debating installing CentOS on a new HP DL580 with an MSA1000 SAN. HP offers drivers that are specific to RHEL and will not install on other RH distros i.e. RH 9. Has anyone gotten the HP SupportPack to install under CentOS? Thanks! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

31 56

CentOS-announce Digest, Vol 3, Issue 14
by centos-announce-request＠centos.org 25 May '05

25 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:427 Moderate CentOS 3 i386 ethereal - security update (Tru Huynh) 2. CESA-2005:427 Moderate CentOS 3 x86_64 ethereal - security update (Tru Huynh) 3. CESA-2005:435 Important CentOS 3 i386 mozilla - security update (Tru Huynh) 4. CESA-2005:435 Important CentOS 3 x86_64 mozilla - security update (Tru Huynh) 5. CEEA-2005:434 Important CentOS 3 x86_64 - centosplus firefox security update (Tru Huynh) 6. CEEA-2005:434 Important CentOS 3 i386 - centosplus firefox security update (Tru Huynh) 7. CESA-2005:427 Moderate CentOS 4 i386 ethereal - security update (Johnny Hughes) 8. CESA-2005:427 Moderate CentOS 4 x86_64 ethereal - security update (Johnny Hughes) 9. CESA-2005:473-01: Moderate CentOS 2 i386 lesstif security update (John Newbigin) 10. CESA-2005:427-01: Moderate CentOS 2 i386 ethereal security update (John Newbigin) ---------------------------------------------------------------------- Message: 1 Date: Tue, 24 May 2005 22:59:07 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2005:427 Moderate CentOS 3 i386 ethereal - security update To: centos-announce(a)centos.org Message-ID: <20050524205907.GA10604(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:427 ethereal security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2005-427.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/ethereal-0.10.11-1.EL3.1.i386.rpm updates/i386/RPMS/ethereal-gnome-0.10.11-1.EL3.1.i386.rpm source: updates/SRPMS/ethereal-0.10.11-1.EL3.1.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update ethereal\* Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

Michael --- Michael <addymin(a)pacbell.net> wrote: > So I downloaded ndiswrapper and during the install, I > received a warning message referring to "4K Stacks" and > that NOT disabling 4k stacks can cause some drivers to >crash. The docs went on to suggest I recompile the > kernel to disable CONFIG_4KSTACKS. > > Question: For really like to stick to the stock CentOS-4 > kernel and notcreate/use a custom one. Has anyone had a >problem using the Linksys WPC54G Cardbus adapter + Centos-4 > and NOT had to use a custom kernel? I have used ndiswrapper on FC3 with the stock kernel without a problem. If you buy the Linksys card, try it first! > Thank you. > Michael Chinn __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new Resources site http://smallbusiness.yahoo.com/resources/

1 0

packages in centos-3.3 base changed
by Leonard Ye 25 May '05

25 May '05

Hi all, Correct me if my understanding is wrong. The [base] repository of centos-3.3 will never change after release. All future updates should go into [update]. I have an autobuild system to build a production server. If the [base] repository will never change after release, then I can maintain the reproducibility of the production server by always installing from the [base] of centos-3.3. Regards, Leonard Ye

1 0

Re: [CentOS] Re: Hi, Bryan; was: Re: pronunciation? <snip> -- don't shoot the messenger ...
by Bryan J. Smith 25 May '05

25 May '05

From: Dag Wieers > Sorry to interrupt but he was describing how you appeared in previous > postings. And I have to say that I felt the same way reading some of your postings. Really? Then I'll re-read them since there's been a second confirmation. Just know that I wasn't trying to make it about good/bad. I'm just trying to make the point that companies aren't just evil/greedy, and sometimes your friend can be your worse enemy (even SCO knows that one ;-). > Maybe it's best to move these topics to another channel. I just wish people didn't feel the need to make comments about Red Hat and SCO. > Can we leave the insults out, please ? > It serves no purpose here. Sorry. I'm just still a little disturbed about the "crap" statement, and everything that went with it. I find that many people just don't believe me sometimes.

6 20

announcement topics
by Joe Pruett 25 May '05

25 May '05

i did some searching in the mailman code and have discovered that mailman uses the VERBOSE flag to the python regular expression package, which means that unescaped spaces in the regular expression are ignored. so you need to change the topics to be like: CentOS\ 4\ i386 or: CentOS[ ]4[ ]i386 i'm not sure how many backslashes will be necessary to make it through to the module correctly, so brackets may be easier. or you could change the subject line format to be more like: CentOS-4-i386 so you could match without spaces.

1 0

Recompiling kernel
by kenkensmile＠netscape.net 25 May '05

25 May '05

Recompiling kernel Hi I am using CentOS 4 and trying to recompile kernel for my AMD Thunderbird 1.4 CPU. I used a manual for fedora 3,but I can not make it. After doing #installkernel 2.6-new arch/i386/boot/bzlmage System.map My comuter says "arch/i386/boot/bzlmage no such a file or directory" Could you possibly help me where the appropriate directory is please? Thank you for your help in advance. Cheers, Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

3 2

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

--- Chris Mauritz <chrism(a)imntv.com> wrote: > The original poster was after a 54mbit wifi card and so > far, all of the > recommendations have been for 11mbit cards. Not true, the WG511 that I recommended is a 54mbit card. > I'd also be > interested if > anyone has positive things to say about any readily > available 54mbit > wifi cards + CentOS/Linux. > > Cheers, > > C > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Michael 25 May '05

25 May '05

Greetings: I'm just installed Centos-4 on an IBM T-21 laptop. So far so good. Now I'd like to pop in a wireless lan adapter. I'm looking at a buying a Linksys WPC54G adapter (although I haven't done so yet). After doing some searching, it looks like the best way to get this card working is via ndiswrapper [http://ndiswrapper.sourceforge.net] and then to use Windoze drivers. So I downloaded ndiswrapper and during the install, I received a warning message referring to "4K Stacks" and that NOT disabling 4k stacks can cause some drivers to crash. The docs went on to suggest I recompile the kernel to disable CONFIG_4KSTACKS. Question: For really like to stick to the stock CentOS-4 kernel and not create/use a custom one. Has anyone had a problem using the Linksys WPC54G Cardbus adapter + Centos-4 and NOT had to use a custom kernel? For that matter, since I haven't purchased the card yet, can I get a recommendation or two about a workable wlan cardbus (g) adapter that could most likely be found at Best Buy/CompUSA/Fry's ? I'd like to be able to easily return the card if things don't work... I did some searching a decent card and it seems that a number of good wlan chipsets are discontinued or hard to find, so I'm slightly confused as to what to get. Thank you. Michael Chinn

2 1

RealPlayer on CentOS 4
by Hugh Tollan 24 May '05

24 May '05

Any ideas folks?? have installed RealPlayer10GOLD on CentOS 4, I have tried to uninstall it with the rpm -e command but I am being told it doesn't exist...when I try to download it again I am told that it is already installed! many thanks in advance _________________________________________________________________ Want to block unwanted pop-ups? Download the free MSN Toolbar now! http://toolbar.msn.co.uk/

4 4

Release date for 3.5
by User Lists 24 May '05

24 May '05

Hi all, Somebody knows when centos 3.5 will be released?? Thank you very much. _________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com

2 1

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > I still disable it though 'cause its a real pain.... Yes, because it's new, the defaults are immature, and the majority of both developers and system administrators don't know much about it. So disable it and let others deal with it if the want to. You have that choice. ;-> But by making it the standard in its EL4 line (including FC2+, with changes in FC3+ which RHEL4 inherited), it forces everyone to start learning it, start reporting good defaults, and get it adopted as a standard by everyone. Red Hat does this all-the-time, and doesn't blink when people start screaming about compatibility because it really only does it when it's really, really a necessary adoption. ;-> As I said before, one person I really feel for is Jorg. The guy is "on-the-ball" with POSIX developments, and reguarly gets chastized for breaking compatibility to do so -- especially when some implementations (e.g., GNU Tar) were non-standard in the first place! ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Ted Kaczmarek <tedkaz(a)optonline.net> > Thanks for the excellent post, no defense experience but dealing with > the street side for quite a while now. I've worked at banks where the developers put the same routines for "ATM withdrawl" in the same scope and access as the "back-end debits/credits." Their same attitude is, "oh, the system is secured by others." And when you don't give up, they are arguing, "oh, it'll push back the release date." Some go as far as talking to management to get an override. And then they _really_hate_you_ when you modify their code and show how easy it is to actually make sure software, or implement MACs at the system-level that do the same thing (but is incompatible with the software). In a nutshell, there are a lot of coders out there that believe their software and routines should access the entire system, no restrictions. Although UNIX is typically better than Windows, largely because Microsoft's application division still writes code for "Chicago" (including MS IE to date), there are still cases where I can't trust it. And I definitely need to make sure a compromise of one component is well outside the access and scope of a more critical item it uses. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Feizhou <feizhou(a)graffiti.net> > What is really needed is the ability to limit access to a file on a per > user account basis (acls), not by locking down via a group permission. And that's POSIX's ACLs, c/o the "Austin Group" work of the IEEE POSIX committee circa 2001 and the X/Open Single UNIX Specification (SUS) version 3. XFS on Linux has had POSIX ACL support since day one (using its own codebase), and it's largely XFS's GPL contributions (and direct port from Irix, unlike IBM who ported JFS from OS/2 and not AIX) to kernel 2.6 (POSIX ACL's were standardized as of the 2.5.3 development branch, thanx largely to SGI). Ext3 has had a varied history in the 2.4.x timeframe, and even Red Hat gave up on them in Red Hat Linux 8.0 until kernel 2.6 in FC2+. But even POSIX ACLs are _still_ Discretionary Access Controls (DAC), atop of the legacy UNIX DACs we're all used to. They just augment discretionary control, and don't solve the MAC problem. MAC limits you, not augments you with delegation, on purpose.. People tend to hate MAC when they are first presented with the conepts, because they expect them to work like DAC. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > As you have pointed out it restricts the security granularity of the > system, which in turn will lead to other "work arounds" to achieve > better granlarity and those work arounds will ultimately lead to > sloppiness, making Johns point very valid indeed. First off, SELinux is _optional_ on a system-wide basis. Secondly, SELinux does not have to affect various services, different distros are free to ship different defaults. Third, in typical Red Hat fashion, they adopt "new technologies with good practices/standards" all-the-time. We have to thank for forcing us back to the GNU C Libraries and an ANSI C++ compiler which has drastically improved run-time/binary compatibility. Lastly, Red Hat, like many others, actually stick to standards. I very much dislike when people complain about "compatibility issues" when all someone is trying to do is "get back to the standard" or "be compliant with the new, universal standard." E.g., several GNU projects -- from GCC 2.x's non-ANSI C++ implementation (and especially the entire, multi-yser GCC 2.9.x "beta" merge of GCC 2.x and EGCS) to GNU Tar through 1.13 -- were forks from standards. And when people finally forced the issue of standards compliance, they get chastized. Heck, one of the people I will always appreciate is Jorg, who has gotten reamed left and right on cdrtools, star, etc... He's probably one of the best Linux developers leading full POSIX 2001 compliance (adding all the new IEEE/SUS "Austin Group" developments in various programs). Now SELinux isn't a half-bad design by the NSA and others. Linux sorely needed MAC and, to a lesser extent, Role Based Access Controls (RBAC) as it's "legacy-only" UNIX access controls was not only falling behind NT, but even most proprietary UNIX flavors. But, again, it's _optional_. Turn if off if you wish, but I think it's about time a distro offered it, and attempted some secure defaults. It is not "sloppy" or "broken," just immature in application of defaults yet -- especially since both developers and sysadmins are not used to it being enabled. So how SELinux any different than any other shift-adoption in Red Hat's history? Now my background is largely in defense with several years in financial (which is, ironically, a major overlap in systems/network accounting, as well as crypto, etc...). And a lot of my job has been to go around and ensure developers and integrators are adhering to security standards. And I'm not just one of those "complainy" types either -- because I'm also a software engineer who regularly refutes the "I have to have root" or "we have to do this" non-sense right back in their own language. Especially when such cases are not really a security issue, but an engineering workflow issue in the first place. E.g., an software engineering development system -- even with run-time and/or target on the same system -- should _never_ be designed so the development, run-time and/or target have full control of the system. All should be sandboxed in different ways so it's very easy for the developer to tear down and rebuild the run-time/target from the development tools. If not, then the development environment is incomplete. I don't know how many times I've seen engineers (and I'm one of them too, so I know how they think) waste time fighting a system mis-configuration they introduced because their development, run-time and/or target environments are not finite and contained. They believe they need full root on the system when they don't. And damn do I hate it when the network admins get on my case because someone put a NIC in permisciuous mode -- the engineer shouldn't even be able to do that! With that said, the person who said that he's worked on Classified Networks and said MAC is not a requirement needs to be re-briefed. Access controls are _always_ implemented, and if a system is unable to conform to the required standard, there is a variance or other exception, and the risk must be mitigated _and_ an "effective enough" manual procedure implemented. I _explicitly_ used the term "accountable" because there are two types of Classified Information -- "non-accountable" (typically US DoD "Confidential" and most "Secret") and then their are "accountable" (various, higher classifications). You can typically get away with common variances and other exceptions with minimal, additional manual accounting for "non-accountable." But any automation helps. When it comes to "accountable," MAC/RBAC really helps a crapload -- and the NSA really "got the ball rolling" for Linux, which was really necessary. As far as financial networks, don't even get me started. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > > On Tue, 2005-05-24 at 08:08, Micha Silver wrote: > > > > > > The best thing to do is add this to /etc/selinux/config > > > > > > SELINUX=disabled > > > > > > And then get on with the real jobs.... > > > > > > > Listening to all the pros and cons of SELinux. > > I'd like to improve the security of our regional web server > using SELinux. > > We have a main regional web site and several virtual > domains, kept up by > > private users, all on the same server. Some of the private > users want to run > > php and database apps on their websites. Up till now I > steered away from > > allowing users to run anything on their sites, since a > breakin to any > > private virtual domain would endanger the whole http > process, including the > > main regional site. I'm preparing to switch over to a new (CentOS 4) > > machine, and I thought to set up a different SELinux > context for each > > virtual domain, so that a vulnerability in someones private > web site would > > be isolated and not be able to crash the other domains. > > Is this achievable *without* SELinux?? > > The simple-minded way has always been to run a separate http > instance bound to a different port or IP address, running as > a different user. If you only have one IP address and need > to appear to be on port 80, you can arrange this with a > virtualhost on the main server that uses proxypass or a > rewriterule that results in a proxy connection to the server > running under the other uid. > Thanks Les, With several virtual domains, setting each up on a separate port with rewrite rules, and running several httpd processes under different UIDs would quickly become not so "simple-minded" Regards, Micha > --- > Les Mikesell > lesmikesell(a)gmail.com > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos >

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > The best thing to do is add this to /etc/selinux/config > > SELINUX=disabled > > And then get on with the real jobs.... > Listening to all the pros and cons of SELinux. I'd like to improve the security of our regional web server using SELinux. We have a main regional web site and several virtual domains, kept up by private users, all on the same server. Some of the private users want to run php and database apps on their websites. Up till now I steered away from allowing users to run anything on their sites, since a breakin to any private virtual domain would endanger the whole http process, including the main regional site. I'm preparing to switch over to a new (CentOS 4) machine, and I thought to set up a different SELinux context for each virtual domain, so that a vulnerability in someones private web site would be isolated and not be able to crash the other domains. Is this achievable *without* SELinux?? Thanks, Micha

2 1

CentOS-announce Digest, Vol 3, Issue 13
by centos-announce-request＠centos.org 24 May '05

24 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:435 Important CentOS 3 ia64 mozilla - security update (Pasi Pirhonen) 2. CEEA-2005:434 Important CentOS 3 ia64 - centosplus firefox security update (Pasi Pirhonen) 3. CESA-2005:434 Important CentOS 4 i386 firefox - security update (Johnny Hughes) 4. CESA-2005:434 Important CentOS 4 x86_64 firefox - security update (Johnny Hughes) 5. CESA-2005:435 Important CentOS 4 i386 mozilla - security update (Johnny Hughes) 6. CESA-2005:435 Important CentOS 4 x86_64 mozilla - security update (Johnny Hughes) 7. CESA-2005:435 Important CentOS 3 s390(x) mozilla - security update (Pasi Pirhonen) 8. CESA-2005:435-01: Important CentOS 2 i386 mozilla security update (John Newbigin) 9. CEEA-2005:434 Important CentOS 3 s390(x) - centosplus firefox security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 May 2005 15:09:44 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:435 Important CentOS 3 ia64 mozilla - security update To: centos-announce(a)centos.org Message-ID: <20050523120944.GE1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2005:435 https://rhn.redhat.com/errata/RHSA-2005-435.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/mozilla-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-chat-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-dom-inspector-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-js-debugger-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-mail-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-devel-1.7.8-1.1.3.1.centos3.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Betr.: [CentOS] VPN
by Thom van der Boon 24 May '05

24 May '05

IF you are not stuck to IPSec, you might want to take a look at OpenVPN (www.openvpn.org) I found OpenVPN easier to install than FreeSWAN (an IPSEC VPN) and have setup an OpenVPN solution between my German office and our mainoffice in a matter of hours. Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> simone72(a)email.it 23.05.2005 18:18:56 >>> Hi list, I am trying to create a VPN between two different locations. On the first location we have a cisco pix 525 Natting the internal 192.168.100.x network, while on the second location we have a Centos3 box Natting via iptables the internal 192.168.10.x netowrk. My goal is to connect this 2 over the internet via IPsec. I created the IPsec Net2Net via the network configuration graphic tool, and I configured the cisco following the howto http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html . From my understanding, I should have an ipsec0 network device showing up, so that I could route all traffic from 192.168.10.x directed to 192.168.100.x through it. The thing is that when I try to ifup ipsec0 I get the following errors: modprobe: modprobe: Can't locate module ripemd160 modprobe: modprobe: Can't locate module cast128 modprobe: modprobe: Can't locate module lzs modprobe: modprobe: Can't locate module lzjh So, after googling and reading a lot with no success, I would like to ask for advice on this, and successfull story :). I really need to have this VPN running, and I am not tied to this one solution only, linux-to-linux VPN, openVPN or anything else you could suggest would be great. Thanks in advice Simone _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

5 9

Re: [CentOS] Microphone problems with Skype
by Angelo Machils 24 May '05

24 May '05

> > >I have CentOS4 and this soundcard: >00:11.5 Multimedia audio controller: VIA Technologies, Inc. >VT8233/A/8235/8237 AC97 Audio Controller (rev 60) > >I installed the Skype rpm for Fedora3 and it works but the quality of >my voice is very poor: volume is low and the voice sound doesn't have >the high frequencies. > >Did any of you made Skype work perfectly under CentOS4? How? > >Thanks, >Adrian > Hi there! I have the same card: 00:11.5 Multimedia audio controller: VIA Technologies, Inc. VT8233/A/8235/8237 AC97 Audio Controller (rev 60) and it works without problems on Skype (also the FC3 RPM). Kind regards, Angelo

4 3

access point radius authentication
by Ryan 24 May '05

24 May '05

I have a CentOS 4 running on a laptop with an orinico card. My Wireless access point supports 802.1x dynamic WEP keys, and I would like to try it in this mode. Unfortunately, its not clear to me on how to: #1: Configure free radius on a server to do the radius backend. (although I think I can solve this) #2: Configure CentOS 4 to use dynamic WEP keys. If anyone knows how to do either of the above, or has any links to relevant help sites, please pass along. thanks, Ryan

2 1

migrating from rhel 3 to centos 3
by Michael Thon 24 May '05

24 May '05

Greetings - I have a rhel 3 server that I want to migrate to centos. The FAQ: http://www.centos.org/modules/smartfaq/faq.php?faqid=19 pretty much tells me what I need to do but what is going to happen when I run yum update? Will it replace every RPM on my system with its centos counterpart or will it only upgrade RPMS as new versions are released? This is a production system and I'm trying to figure out what apps will potentially be affected by the migration. Also, should I uninstall the up2date package when I'm done? Thanks! Mike

2 1

iptables problem
by joseph medina 23 May '05

23 May '05

Some day ago, a friend post one problem for mi. whist this texts: I have a server whit 2 interfaces of network, where eth0 is the interfaces connetc to internet and eth1 to the internal network. This server hace a Squid only, but i setting the iptables for protection to the server. Iptables run from script and in this script i setting the redirection for the other server in my internal network to port 80 and 443. I follow the diferent how to and many manual, but the redirect no work, the NAT POSTROUTING work and the squid work to. My DNS is Ok, because the consult whit dig command the answer is the assigned ip. Here put the copy of my script: I was do all instruccion for that problem but I have the same problem, te server dont redirect to webserver for ports 80 and 443 all the rest services are ok only that services have problems, thanks for all now my /etc/sysconfig/iptables is this: # Firewall configuration written by redhat-config-securitylevel # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] #-A INPUT -j RH-Firewall-1-INPUT #-A FORWARD -j RH-Firewall-1-INPUT #-A RH-Firewall-1-INPUT -i lo -j ACCEPT #-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT #-A RH-Firewall-1-INPUT -p 50 -j ACCEPT #-A RH-Firewall-1-INPUT -p 51 -j ACCEPT #-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT #-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited #todo al localhost y a infocom -A INPUT -i lo -j ACCEPT -A INPUT -i eth0 -s rango_ip -d 0/0 -p all -j ACCEPT -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.1/32 -p all -j ACCEPT #negamos el ping -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP -A INPUT -i eth1 -p ICMP --icmp-type echo-request -j DROP ## SALIDA SMTP - Para que el servidor se pueda conectar a otros MTA # Permitir salida SMTP -A INPUT -p tcp -m tcp --sport 25 -j ACCEPT -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT ## DNS Completo. ACEPTADO. -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT ## SQUID -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT ## FORWARD -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT -A FORWARD -i eth1 -p tcp -d 172.16.0.3/32 --dport 80 -j ACCEPT -A FORWARD -i eth1 -p tcp -d 172.16.0.3/32 --dport 443 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT -A FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT ##OUTPUT -A OUTPUT -o eth1 -p tcp --dport 80 -j ACCEPT -A OUTPUT -o eth1 -p tcp --dport 443 -j ACCEPT -A OUTPUT -o eth1 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth1 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT COMMIT *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] ##NAT e intranet des de el portal -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.138/32 -o eth0 -j MASQUERADE COMMIT -------------------------------------------------------------- my /etc/sysconfig/iptables- # Additional iptables modules (nat helper) # Default: -empty- IPTABLES_MODULES="ip_nat_ftp" # Save current firewall rules on stop. # Value: yes|no, default: no #IPTABLES_SAVE_ON_STOP="no" # Save current firewall rules on restart. # Value: yes|no, default: no #IPTABLES_SAVE_ON_RESTART="no" # Save (and restore) rule counter. # Value: yes|no, default: no #IPTABLES_SAVE_COUNTER="no" # Numeric status output # Value: yes|no, default: no #IPTABLES_STATUS_NUMERIC="no" ----------------------------------------- the command iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- 200.55.135.8/29 anywhere ACCEPT all -- 172.16.0.0/24 valinor.mincex.org DROP icmp -- anywhere anywhere icmp echo-request DROP icmp -- anywhere anywhere icmp echo-request ACCEPT tcp -- anywhere anywhere tcp spt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:squid Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.16.0.0/24 anywhere tcp dpt:http ACCEPT tcp -- 172.16.0.0/24 anywhere tcp dpt:https ACCEPT tcp -- anywhere armagedon.mincex.orgtcp dpt:http ACCEPT tcp -- anywhere armagedon.mincex.orgtcp dpt:https ACCEPT tcp -- 172.16.0.0/24 anywhere tcp dpt:domain ACCEPT udp -- 172.16.0.0/24 anywhere udp dpt:domain Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:https Chain RH-Firewall-1-INPUT (0 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited -------------------------------------------------------- and the command iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere anywhere tcp dpt:http to:172.16.0.3:80 DNAT tcp -- anywhere anywhere tcp dpt:https to:172.16.0.3:443 ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:https Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- ariadne.mincex.org anywhere MASQUERADE all -- 172.16.0.10 anywhere MASQUERADE all -- 172.16.0.9 anywhere MASQUERADE all -- maprinter.mincex.org anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ______________________________________________ Renovamos el Correo Yahoo! Nuevos servicios, más seguridad http://correo.yahoo.es

1 0

Re: Hi, Bryan; was: Re: pronunciation? <snip> --
by Bryan J. Smith <b.j.smith＠ieee.org> 23 May '05

23 May '05

From: Feizhou <feizhou(a)graffiti.net> > I still remember the FIRST Linux GUI installer for a Linux distro. It > came on the Caldera Openlinux 2.2. It worked. It was really nice. Actually, the first distro with a GUI installer was Yggdrasil, circa 1993. It installed on 8MB of RAM using X and Athena/FVWM. > The Novell guys that were behind Caldera deserve plenty of respect for > what they have done. Despite what someone else said, I was (and still am somewhat) of a major skeptic of Novell. Novell new it had to get off of its DOS Protected Mode Interface (DPMI) OS approach, and seriously considered Linux. But instead of going Linux 10 years earlier than they did, they bought UNIX(R) from AT&T USL. That's when Ray Noorda, basically the man who made Novell who they are, broken off and founded Caldera. Novell never worked much with Caldera, and withheld pretty much all their core technologies. Ironic because had Novell not, they would be in a far stronger position on Linux than they are today. We might not even be talking about Red Hat. But, once again, this is all just fluff. What really matters is the GPL donations. Novell has pleasantly surprised me because they have basically GPL'd everything SuSE had not, as well as even a few of their technologies. Now they still have their core technologies that they will never GPL -- just like Sun, etc... and are no where near Red Hat's 100% GPL-centric focus. But unlike Red Hat, I have to say they are the first PC-centric software developer that "gets it" and whenever these "debates" go on with Microsoft and Open Source companies -- Novell always puts their arguments in terms that traditional Microsoft consumers can understand. And Novell seems to understand how to treat the distribution channel, especially system integrators, better than Red Hat too. As I've always said on other lists, it's like a replay of Apple-IBM-Microsoft. Apple thought IBM was their enemy, and partnered with Microsoft only to be blindsided. Same deal here. Sun thinks Red Hat is their enemy, and they have partnered with Novell. Novell not only has them on the OS front, but they offer a GPL implementation of .NET too (which essentially is based on Java 1.1 code -- although .NET 2.0 is now modernized with the Microsoft relicense). > I think, today's SCO bashing should really go to the current owner of > SCO and to IBM. IBM for what they did and the guy who put McBride in > place to do the stock game. I don't defend SCO's lobbying and Linux IP "smokescreen." They are a company who is fighting our right to digital assembly, and they are now an abomination. But had it not been for the rabid response by the Linux community not to stop and recognize the original March 2003 filing was about Monterey -- something even Linus, ESR and many other people themselves explicitly called a "contract dispute" in countless media interviews -- SCO wouln't have been able to put up this Linux IP "smokescreen." So many people had made SCO v. IBM into SCO v. Linux -- calling for the end of the lawsuit and whatnot -- well before SCO even introduced the Linux IP issue. We gave them the avenue to take. IBM is no better than SCO. But I will admit that in the transcripts I have read, IBM's lawyers are doing a great job of using the GPL, and making the judge aware of what it entails. The judge is really good, and isn't giving SCO anything on the Linux IP front. But unfortunately for IBM, the judge has granted several SCO motions that have everything to do with Monterey, and any Monterey code that competes with Linux. Because that's what this is about, Monterey, the withholding of Monterey/IA-64 (UnixWare 8) and the Non-Compete. And if it does make it to a jury trial in Utah, I don't see how any juror won't see this as a patent and capital giant screwing over a smaller company because it could. Especially since Caldera-SCO's strategy was no different than IBM's, and the whole reason for the contract was to protect Caldera-SCO against what IBM did. Even if IBM found a loophole, I still see Caldera-SCO winning some counts on IBM not maintaining the contract "in good faith" well before they broke it. And that's what worries me most. When Caldera-SCO wins on some Monterey counts, the media will translate that into SCO proving their IP is in Linux, largely because lots of the rabid Linux world will be screaming "why? how?" because they just don't know what the case is all about. They never have. Which is my point. Not that SCO is good / IBM is bad. But there are contract disputes and corporate strategies at work here -- they always have been -- and you can't side with one company and demonize another without realizing all the details that brought it to this. Especially the valuable lesson that even the most pro-Linux, pro-GPL company can still be competitor #1 to IBM, and IBM will destroy them. > I really don't understand why some people get so uptight about it. I > look after over 30 machines and I have had no problems moving on to > Fedora Core 1 and Fedora Core 2. In fact, I like their Fedora project > more than their RHL line. >From what I saw, once the execs "took the shakles off" the RHL developers as they no longer considered RHL a "product" anymore once it became FC, there was a lot of "clean-up" in FC. The big one was inter-dependency hell that had built up over the years. And there were other security changes (this is before SELinux) that were just sound -- especially getting rid of SUID root on a lot of things. Unfortunately, I see DAG's points on the lack of consideration of multi- version aware SPEC files. They explain a lot of issues I'm seeing in Fedora Core releases. And if the quality of FC slides, then it will affect RHEL as well. Which is why I'm either hopeful Red Hat realizes this, or maybe Novell-SuSE's version 10 strategy will offer what we've been used to in the RHL/RHEL space. > I personally don't have a problem with the Red Hat business decision ... > but I understand why some people do. I think people forget that the strategy was set the moment SuSE introduced SuSE Linux Enterprise Server (SLES). Red Hat introduced RHEL years before the Fedora Core project was even announced, and that included cutting updates to 1 year, discouraging certification on RHL in favor of RHEL (which most vendors wanted anyway -- a product good for 5+ years, with an 18 month cycle instead of 6 month), etc... Fedora(TM) was just a trademark issue -- something only Red Hat, of all vendors, had because they were the only company that had allowed people to distribute major modifications with their trademark. Even Sun had to license SuSE(R), and continued to abuse Red Hat(R) for years without a license until their SuSE-based Java Desktop came out. Why? Because Sun had legal ground to stand on claiming Red Hat never enforced their trademark. > That lifetime support you are looking at is far less than 2 years I can > assure you. It all depends. What I see people complaining about on Red Hat is typically two things: 1) Free 3-4 years of updates 2) A "brand name" that the boss will allow in the company #1 should have never happened, and why Red Hat maintained 3-4 years of updates for 6-7 simultaneous revisions is beyond me. *NO* other commercial distributor has even come close, and even SuSE rarely makes its 2 year promises on SL. #2 is probably the real complaint most people have, and it goes back to the trademark. With RHL, you used to be able to install Red Hat Linux and because your boss though Red Hat was the Microsoft of Linux, he thought it was well supported. Now that's more difficult to do with "Fedora" as the boss reads in the IT media that it's cutting edge and unstable. > CentOS offers the free and the long lifetime. I personally don't care > too much since the advantages on newer Fedora Cores outweigh a > 'supported' but static distro. However, others may not see it that way > and so it is good that CentOS is here. I think the CentOS project is a great endeavor. And I like many aspects of the Fedora Project, and Fedora Core itself. I have some increasing concerns though, but they aren't because Red Hat is "greedy," "listening to its stockholders," etc... Hell, there is a reason why Red Hat allowed major GPL projects to buy stock before the IPO -- because it wanted sharedholders who understand their GPL-centric model. > At the same time, I find it offensive when people starting saying 'Dead > Rat' just because the RHL line was pulled and they forget all the work > that Redhat puts into the Linux kernel, gcc, glibc and a host of others > that are at the core of any Linux distribution. Which is why people like yourself and myself are not popular. We ask people to stop and appreciate the CentOS project without resorting to demonizing Red Hat (or Caldera-SCO, or anyone else). That's not popular with the majority, rabid Linux community. They want to make it about Microsoft, Red Hat, SCO or whomever else. They want to interject this "hate" -- and that's what it is -- on a regular basis. We're in the minority because we don't stoop to that level. In fact, I'm sure I'm very much hated because I'm the jerk who takes the time to try to explain things. In reality, I just give these people an excuse to say I'm "OT" -- but as I said, you can't chastize me without realizing all of the OT, snide and other non-technical comments we see regularly. I just have to use Linus and many others as examples, they stay focused on the source. They keep IBM from getting patents in the kernel, they question donations from other companies as well -- giving real refutement to arguments like those from SCO -- and keep our GPL focused on what it needs to be. And that's not petty comments on whomever we hate today. I'm sure I'm going to piss a lot of people off with this next comment, but it's what I'm seeing more and more. As an opinionated American who believes strongly in capitalism (largely because we Americans are too individualistic for government mandated socialism to work), I am regularly reminded on how sometimes just an American company can be so demonized. I used to think maybe I was just paranoid, but after Utah-based Novell bought Germany-owned SuSE, I started seeing a lot of the anti-Red Hat comments start to be made of SuSE as well. Ironic because the first thing Novell started doing was GPL'ing all sorts of SuSE -- and they are even releasing the first, feature-complete, 100% redistributable ISOs as of 9.2. But before, SuSE was called a "good" company, despite their non-GPL focus at times, and I always thought it was ironic that they were not held to the same standard as Red Hat. But in reality, I have noticed in the software industry -- being that Linux is a global effort -- I have repeatedly seen American companies held to a higher standard, and many of their charity simply discarded. At the same time, companies like IBM can play "Quiz Show" type games with marketing and money, and suddenly people are fooled into thinking they are charitable. On pure dollar amounts, IBM doens't compare to Red Hat, HP or even Sun on actual GPL or even GPL compatible donations. And the reality is that only GPL or GPL compatible software is the thing that remains, no matter what changes. People tend to not understand that there is a major difference between choosing to work together in a public commons and government-mandated public organization. There is -- and it's massive. A public commons in a capitalistic society is a good thing. We choose to work together and we benefit from our efforts, which we make freely. Even Red Hat does this, as well as HP, Sun and, to a lesser extent, even IBM. But the one thing I repeatedly see is people blaming Microsoft for their problems -- which mirrors the other "absolute blames" I continually see for all sorts of things. The reality is that you can't mandate Linux or otherwise force people. People must be allowed to choose Microsoft if they wish, or anything else. The concept of "we know better than you" scares me to death. And it's the attitude I see used against companies regularly, especially against American companies. I believe strongly in public commons, as long as people choose to do so freely. And Red Hat has continually been the only commercial Linux company that has a 100% GPL focus. And they aren't some social-idealistic company in a socialistic economy -- but an American company in a capitalistic economy that believes strongly in never betraying the public trust. They understand Stallman's "moral delima" -- ironically another American. And some of us are just too busy to play the "blame game." -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Microphone problems with Skype
by Adrian Coman 23 May '05

23 May '05

Hi, I have CentOS4 and this soundcard: 00:11.5 Multimedia audio controller: VIA Technologies, Inc. VT8233/A/8235/8237 AC97 Audio Controller (rev 60) I installed the Skype rpm for Fedora3 and it works but the quality of my voice is very poor: volume is low and the voice sound doesn't have the high frequencies. Did any of you made Skype work perfectly under CentOS4? How? Thanks, Adrian

5 6

CentOS-announce Digest, Vol 3, Issue 12
by centos-announce-request＠centos.org 23 May '05

23 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:434 Important CentOS 4 ia64 firefox - security update (Pasi Pirhonen) 2. CESA-2005:435 Important CentOS 4 ia64 mozilla - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 May 2005 14:44:36 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:434 Important CentOS 4 ia64 firefox - security update To: centos-announce(a)centos.org Message-ID: <20050523114436.GC1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2005:434 https://rhn.redhat.com/errata/RHSA-2005-434.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/firefox-1.0.4-1.4.1.centos4.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

RE: [CentOS] RE: Wireless Networking
by Vaneet Sharma 23 May '05

23 May '05

Thankx I solved the problem by removing firewall and now trying to include firewall settings step by step Vaneet -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Ryan Sent: Monday, May 23, 2005 10:35 AM To: CentOS mailing list Subject: Re: [CentOS] RE: Wireless Networking > 1) I am not able to connect to my Centos Server BOX through Secure CRT > 2) I am not able to connect to my Centos using FTP. Try configuring port forwarding on the router instead of DMZ. For SSH , forward port 22 to the 192.x address our centos machine is on. Make sure iptables has 22 open in its firewall settings. Vaneet Sharma wrote: > Dear All, > > I have one centos box ( centos 4.0 ) which is connected to MSI > wireless router....... And which is connected to my ISP MODEM. I > incorporated wireless router so that I can use my laptop from any of > my rooms. > > Now this Centos 4.0 box is my home server machine. > > The MSI Wireless Router has DHCP server enabled. Wireless router has > provided each address to my machines basically internal IP address > like 192.168.1.xx TO 192.168.1.xx. The wireless router has an > external IP which can be reached at : http://84.255.28.48:8080. I > configured DMZ settings in wireless router... Which basically is > mapping my Centos Box internal IP ( 192.168.1.XX ) to public IP ( > 84.255.28.48 ) > > Now the problem is the following: > > how will my centos machine listen to this public IP ? Do I have to set > up firewall settings?> Ifconfig on centos gives me internal IP. I need > to know what routing settings I need to do and where ? > > 1) I am not able to connect to my Centos Server BOX through Secure CRT > 2) I am not able to connect to my Centos using FTP. > > Kind regards > Vaneet > > > -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Maciej Zenczykowski > Sent: Friday, May 20, 2005 5:39 PM > To: CentOS mailing list > Subject: Re: [CentOS] Iptables - PREROUTING > > > okay, first of all you shouldn't do it in a script, > instead you should be modifying /etc/sysconfig/iptables > and using /etc/init.d/iptables start/stop > > and add ip_nat_ftp to the proper spot (modules to load) in > /etc/sysconfig/iptables-config > > next you need to rewrite the following for iptables-save/restore > format > > *nat > :PREROUTING ACCEPT [0:0] > :OUTPUT ACCEPT [0:0] > :POSTROUTING ACCEPT [0:0] > > [spot for nat rules] > > COMMIT > > *filter > :INPUT DROP [0:0] > :FORWARD DROP [0:0] > :OUTPUT ACCEPT [0:0] > > [spot for filter rules] > > COMMIT > > > [in the filter rules:] > -A INPUT -i lo -j ACCEPT > > # the following is _not_ nice > -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP > > -A INPUT -i eth0 -s rango_ip/29 -d 0/0 -p all -j ACCEPT > -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.211/32 -p all -j ACCEPT > > > [above in the nat spot] > -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 -A > PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 > > > [again in the filter spot] > -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT -A > FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT > > -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT -A > FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT > > You _DO_ _NOT_ WANT TO ACCEPT everything from port 53 - I can break > through this firewall in 5 seconds. > -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT > -A INPUT -p udp -m udp --dport 53 -j ACCEPT > > same here, plus squid doesn't use udp > -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT > > the default should be to drop > > -A INPUT -j LOG --log-level info > -A OUTPUT -j LOG --log-level info > -A FORWARD -j LOG --log-level info > > [in nat again] > -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE > -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE > -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE > > > this should be in /etc/sysctl.conf > >>echo 1 > /proc/sys/net/ipv4/ip_forward > > > do the above changes and repost with what you have and we'll go from > there... > > Cheers, > MaZe > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos > > > Vaneet Sharma > executive manager > iDeasTank Limited > an iwg business > dolphins' court po 388 > valletta, m-malta/europe > mobile: +356 9943 8263 > skype: CALLVANEET > fax: +356 9952 8888 > phone: +356 9942 8888 > > vaneet(a)iwg.info > call me on www.skype.com - my ID is CALLVANEET > > Want a signature like this? - www.plaxo.com\signature > > iwg is a global e-mobile company creating, building and growing new > businesses. iwg founders are pioneers in creating multi-billion > dollar mobile and Internet businesses in Europe, Asia and the US. > > www.iWG.info > www.countryprofiler.com/iWG > www.visitmalta.com > www.mfc.com.mt > > > Privileged/Confidential Information may be contained in this message. > If you are not the addressee indicated in this message (or responsible > for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > > _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos Vaneet Sharma executive manager iDeasTank Limited an iwg business dolphins' court po 388 valletta, m-malta/europe mobile: +356 9943 8263 skype: CALLVANEET fax: +356 9952 8888 phone: +356 9942 8888 vaneet(a)iwg.info call me on www.skype.com - my ID is CALLVANEET Want a signature like this? - www.plaxo.com\signature iwg is a global e-mobile company creating, building and growing new businesses. iwg founders are pioneers in creating multi-billion dollar mobile and Internet businesses in Europe, Asia and the US. www.iWG.info www.countryprofiler.com/iWG www.visitmalta.com www.mfc.com.mt

1 0

RE: Wireless Networking
by Vaneet Sharma 23 May '05

23 May '05

Dear All, I have one centos box ( centos 4.0 ) which is connected to MSI wireless router....... And which is connected to my ISP MODEM. I incorporated wireless router so that I can use my laptop from any of my rooms. Now this Centos 4.0 box is my home server machine. The MSI Wireless Router has DHCP server enabled. Wireless router has provided each address to my machines basically internal IP address like 192.168.1.xx TO 192.168.1.xx. The wireless router has an external IP which can be reached at : http://84.255.28.48:8080. I configured DMZ settings in wireless router... Which basically is mapping my Centos Box internal IP ( 192.168.1.XX ) to public IP ( 84.255.28.48 ) Now the problem is the following: how will my centos machine listen to this public IP ? Do I have to set up firewall settings?> Ifconfig on centos gives me internal IP. I need to know what routing settings I need to do and where ? 1) I am not able to connect to my Centos Server BOX through Secure CRT 2) I am not able to connect to my Centos using FTP. Kind regards Vaneet -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Maciej Zenczykowski Sent: Friday, May 20, 2005 5:39 PM To: CentOS mailing list Subject: Re: [CentOS] Iptables - PREROUTING okay, first of all you shouldn't do it in a script, instead you should be modifying /etc/sysconfig/iptables and using /etc/init.d/iptables start/stop and add ip_nat_ftp to the proper spot (modules to load) in /etc/sysconfig/iptables-config next you need to rewrite the following for iptables-save/restore format *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] [spot for nat rules] COMMIT *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] [spot for filter rules] COMMIT [in the filter rules:] -A INPUT -i lo -j ACCEPT # the following is _not_ nice -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP -A INPUT -i eth0 -s rango_ip/29 -d 0/0 -p all -j ACCEPT -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.211/32 -p all -j ACCEPT [above in the nat spot] -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 [again in the filter spot] -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT -A FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT You _DO_ _NOT_ WANT TO ACCEPT everything from port 53 - I can break through this firewall in 5 seconds. -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT same here, plus squid doesn't use udp -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT the default should be to drop -A INPUT -j LOG --log-level info -A OUTPUT -j LOG --log-level info -A FORWARD -j LOG --log-level info [in nat again] -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE this should be in /etc/sysctl.conf > echo 1 > /proc/sys/net/ipv4/ip_forward do the above changes and repost with what you have and we'll go from there... Cheers, MaZe _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos Vaneet Sharma executive manager iDeasTank Limited an iwg business dolphins' court po 388 valletta, m-malta/europe mobile: +356 9943 8263 skype: CALLVANEET fax: +356 9952 8888 phone: +356 9942 8888 vaneet(a)iwg.info call me on www.skype.com - my ID is CALLVANEET Want a signature like this? - www.plaxo.com\signature iwg is a global e-mobile company creating, building and growing new businesses. iwg founders are pioneers in creating multi-billion dollar mobile and Internet businesses in Europe, Asia and the US. www.iWG.info www.countryprofiler.com/iWG www.visitmalta.com www.mfc.com.mt Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss