Discuss

discuss@lists.centos.org

34753 discussions

Limiting fuse-mounted NTFS drive access?
by Scott Ehrlich 05 Jul '10

05 Jul '10

I have a CentOS 5.5 system that is dual-boot CentOS 5.5 and Windows XP w/SP3 formatted with NTFS (for the Windows partition, of course). I have installed fuse (ntfs-3g) to allow read/write access to the NTFS partition from CentOS. No regular user has sudo. What is the best way to limit the access a user logging into the CentOS from mangling or changing data in unwanted areas of the fuse-mounted NTFS partition? I presume this would be somewhere in /etc/fstab, but what should the mount line say for at least write limitations? Thanks. Scott

2 1

centos 5.2
by Roland RoLaNd 05 Jul '10

05 Jul '10

Hello, where can i get centos 5.2 64 bit ? all i can find is 5.5 ... any help? _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

3 2

text to html
by Jozsi Avadkan 05 Jul '10

05 Jul '10

input: http://pastebin.com/raw.php?i=MqPXZwc3 output: http://pastebin.com/raw.php?i=8QCkp4yv it will be a long day.. :D could someone please help with it? i have to make a "one liner" that get's the input, and gives the mentioned output.

6 9

prelink
by Frank Cox 05 Jul '10

05 Jul '10

The above discussion of prelink gave me pause for thought... I have a "suite" of programs that I install in their own directory, along with their datafiles, under /opt. Would it be a good idea to add that directory to /etc/prelink.conf? What could go wrong? -- MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com

2 2

qemu
by mattias jonsson 05 Jul '10

05 Jul '10

How to use qemu with a network brdige The bridge should have dhcp Not nat

6 9

ESXi, KVM or Xen?
by Emmanuel Noobadmin 03 Jul '10

03 Jul '10

Which of these would be the recommended virtualization platform for mainly CentOS guest on CentOS host for running a virtualized mail server? From what I've read, objectively it seems that VMWare's still the way to go although I would had like to go with Xen or KVM just as a matter of subjective preference. VMWare's offering seems to have the best support and tools, plus likely the most matured of the options. Also given their market dominance, unlikely to just up and die in the near future. Xen would had been a possible option except Redhat appears to be focusing on KVM as their virtualization platform of choice to compete with VMWare and Citrix. So maybe Xen support will be killed shortly. Plus the modified xen kernel apparently causes conflict with certain software, at least based on previous incidents where I'd been advised not to use the CentOS xen kernel if not using xen virtualization. KVM would be ideal since it's opensource and would be supported in CentOS as far as can be reasonably foreseen. However, looking at available resources, it seems to have these key disadvantages 1. Poorer performance under load. http://wiki.xensource.com/xenwiki/Open_Topics_For_Discussion?action=AttachF… This 2008 XenSummit paper indicates that it dies on heavy network load as well as when there are more than a few VM doing heavy processing at the same time. But that's two years ago and they weren't using paravirtual drivers it seems. http://vmstudy.blogspot.com/2010/04/network-performance-test-xenkvm-vt-d.ht… This blog testing out Xen/KVM pretty recently. While the loads are not as drastic and neither the difference, it still shows that KVM does lag behind by about 10%. This is a concern since I plan to put storage on the network and the most heavy load the client has is basically the email server due to the volume plus inline antivirus and anti-spam scanning to be done on those emails. Admittedly, they won't be seeing as much emails as say a webhost but most of their emails come with relatively large attachments. 2. Security Some sites point out that KVM VM runs in userspace as threads. So a compromised guest OS would then give intruder access to the system as well as other VMs. Should I really be concerned or are these worries only for extreme situations and that KVM is viable for normal production situations? Are there other things I should be aware of?

7 7

Help: Please help me size my server requirements
by Sanjay Arora 03 Jul '10

03 Jul '10

I am looking to build a Workgroup Server. (Should be compatible/certified with both XEN & VMware hypervisors, as I am not sure which one I will settle with...comments requested) To run baremetal on hypervisor, with each of the following services running virtualized with minimum OS install (CentOS 5.x, latest stable release). - Multi-homed router-cum-border firewall (Access to Network Card limited to this instance...will act as router for rest of virtual machines). - DNS Server (djbDNS). - Mail Server (Qmail). - News Server (INN). - Webserver (Apache). - RDBMS (postgreSQL...highest load). In addition to above the server to provide Windows RDP &/or Linux Desktop Thinclient to 5 users running diskless thin clients or old desktops (second highest load). Server to have adequate amount of memory for the above and 500 GB/1 TB RAID 5 or better using SATA disks. What Server Specs. I am looking at? I understand DB load is major in this but assuming moderate to medium db load, what do I need. Will seperate the server & Thinclient server six months/year down the road. What budget? Recommendations for a processor/motherboard/ram/disks/sata card? With best regards and thanks in advance. Sanjay Arora.

1 0

kvm as non-root user
by David McGuffey 03 Jul '10

03 Jul '10

Tried as I might, I cannot get kvm on CentOS 5.4 to run as a non-root user. Have Googled and followed guidance I've found (put the regular user in the kvm group, change permissions on several files, etc.). Anyone have decent (e.g., working) guidance on how to do this? Dave M

2 3

Windows 2003 AD, Winbind, Kerberos and NFSv4
by James A. Peltier 03 Jul '10

03 Jul '10

Hi All, I'm having a bit of difficulty getting a CentOS 5.5 Kerberized NFSv4 server working. This server is configured as a Winbind client to a Windows 2003 Active Directory. I've successfully bound it to AD and I am able to authenticate. I've successfully created a NFSv4 entry in /etc/exports to export the /exports directory and I can successfully mount a non-Kerberized NFSv4 mount on a client machine. I now want to take it to the next step and add Kerberos and it doesn't seem to be working for me. Below are my configurations and the steps I performed. Fresh install of CentOS 5.5. Non-Kickstarted. Wanted to get it working manually first. Used the First Boot Authentication Wizard to configure Winbind Support for User Information. Configured Winbind and Kerberos under the Authentication Tab Checked Local auth is sufficient and Create home directories under options The computer successfully joins the domain and appears in the Computer container in AD. Below is the extract from /etc/samba/smb.conf for authconfig plus what I changed, everything else is stock. I disabled the firewall and SELinux is running in permissive mode on both the test server and test client. #======================= Global Settings ===================================== [global] #--authconfig--start-line-- # Generated by authconfig on 2010/07/01 18:32:54 # DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--) # Any modification may be deleted or altered by authconfig in future workgroup = MY.AD.NAME password server = MY.AD.SERVER realm = MY.AD.NAME security = ads idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/bash #--authconfig--end-line-- #-- my additions/changes-start -- template homedir = /home/%U winbind use default domain = true winbind offline logon = true winbind nested groups = true winbind refresh tickets = true use spnego = yes use kerberos keytab = yes #-- my additions/changes-end -- It also created an appropriate, I believe, /etc/krb5.conf to which I removed only the .example.com stuff resulting in the following file. [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = MY.AD.NAME dns_lookup_realm = false # with and without true tried for these dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes [realms] MY.AD.NAME = { kdc = MY.AD.SERVER admin_server = MY.AD.SERVER kdc = MY.AD.SERVER } [domain_realm] my.ad.name = MY.AD.NAME .my.ad.name = MY.AD.NAME [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } If I log into this host I am properly issued a Kerberos ticket from AD so it would appear that Kerberos is working properly [jpeltier@oak ~]$ ssh aconite klist jpeltier@aconite's password: klist: You have no tickets cached Ticket cache: FILE:/tmp/krb5cc_16777216_ltvWwy Default principal: jpeltier(a)MY.AD.NAME Valid starting Expires Service principal 07/02/10 10:46:43 07/02/10 20:46:43 krbtgt/MY.AD.NAME(a)MY.AD.NAME renew until 07/02/10 20:46:43 Kerberos 4 ticket cache: /tmp/tkt16777216 [jpeltier@oak ~]$ Now I configured NFSv4 exports on the server /exports *(rw,fsid=0) Edited /etc/sysconfig/nfs to change # Set to turn on Secure NFS mounts. #SECURE_NFS="yes" to # Set to turn on Secure NFS mounts. SECURE_NFS="yes" restarted NFS service and it appears as an export [root@aconite ~]# /etc/init.d/nfs restart Shutting down NFS mountd: [ OK ] Shutting down NFS daemon: [ OK ] Shutting down NFS quotas: [ OK ] Shutting down NFS services: [ OK ] Shutting down RPC svcgssd: [ OK ] Starting RPC svcgssd: [ OK ] Starting NFS services: [ OK ] Starting NFS quotas: [ OK ] Starting NFS daemon: [ OK ] Starting NFS mountd: [ OK ] [root@aconite ~]# exportfs /exports <world> [root@aconite ~]# To support NFSv4 with Kerberos security, we also need to generate service principal for NFS: [root@aconite ~]# net -U administrator ads keytab add nfs which then looks like this [root@aconite ~]# klist -k Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME Test on the client [root@celastrina ~]# showmount -e aconite Export list for aconite: /exports * [root@celastrina ~]# mount -t nfs4 aconite:/ /mnt [root@celastrina ~]# mount |grep -i nfs4 aconite:/ on /mnt type nfs4 (rw,addr=199.60.1.84) [root@celastrina ~]# So as you can see everything is now working *without* Kerberos. However, if I change the /etc/exports file on aconite to [root@aconite ~]# cat /etc/exports /exports gss/krb5(rw,fsid=0) [root@aconite ~]# exportfs /exports gss/krb5 and then try to mount with the -o sec=krb5 on the client [root@celastrina ~]# mount -t nfs4 -o sec=krb5 aconite:/ /mnt mount.nfs4: Permission denied and the entry in /var/log/messages on celastrina is Jul 2 11:21:57 celastrina rpc.gssd[3302]: Using keytab file '/etc/krb5.keytab' Jul 2 11:21:57 celastrina rpc.gssd[3302]: WARNING: Failed to obtain machine credentials for connection to server aconite.my.ad.name nothing appears in the logs on aconite. If you've been kind enough to read this entire thread could you be kind enough to let me know what I am missing or doing wrong? It seems so close now that I can taste it, but this one last piece doesn't seem to want to fall into place. :( -- James A. Peltier Systems Analyst (FASNet), VIVARIUM Technical Director HPC Coordinator Simon Fraser University - Burnaby Campus Phone : 778-782-6573 Fax : 778-782-3045 E-Mail : jpeltier(a)sfu.ca Website : http://www.fas.sfu.ca | http://vivarium.cs.sfu.ca http://blogs.sfu.ca/people/jpeltier MSN : subatomic_spam(a)hotmail.com TEAMWORK There's power in numbers. Learn to work together.

3 4

File sharing solution
by Jussi Hirvi 02 Jul '10

02 Jul '10

I would like to offer my isp clients a solution for sharing (big) files, basically on one-to-one basis. This is how I imagine it: - an anonymous or registered user can upload a file - on response (s)he will get a file-specific (or batch-specific) username/password - (s)he can send a link and un/pw by email - the receiver can download the file - the file will be automatically deleted from the server in n days There must exist an opensource solution for this, but I could not find it by google. Where to look for it? - Jussi -- Jussi Hirvi * Green Spot Topeliuksenkatu 15 C * 00250 Helsinki * Finland Tel. +358 9 493 981 * Mobile +358 40 771 2098 (only sms) jussi.hirvi(a)greenspot.fi * http://www.greenspot.fi

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss