Discuss

discuss@lists.centos.org

3 participants
34748 discussions

What is /etc/subuid ?
by Valeri Galtsev 18 Oct '19

18 Oct '19

Dear Experts, Could someone enlighten me about the following file: /etc/subuid ? This file appears to be owned by "setup" package. This is CentOS 7 system, and until now these files if existed were never changed. Today I have added user quite routine way, by doing /usr/sbin/groupadd -g 4500 [username] /usr/sbin/useradd -g [username] -u 4500 -c "User Name, email@domain" [username] And the file /etc/subuid changed and user was added into it: [username]:100000:65536 Nothing like that was happening before. This is first time I create account after update done on Oct 3, 2019. I checked several CentOS 7 machines, basically doing this: # grep subuid /usr/sbin/useradd Binary file /usr/sbin/useradd matches And CentOS 7 machines indeed may have that file name in the useradd binary. None of CentOS 6 machines has that. I tried to do FreeBSD-ism: man /etc/subuid came empty, and realized that I'm doing FreeBSD-ism. I tried to do search on the web (did not "google", I use duckduckgo... so I "did search"), and came pretty much empty. Is it just me, or indeed something in CentOS 7 indeed changed? And what is it? Another question on the same note: how do we find out what the file is about and is used for in Linux, apart from searching on the web. (When there are surprises like the one I had today, one does like to know what this particular file is used for). Thanks in advance for your answers. Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

5 7

Crashed a CentOS 8 installation.
by Thomas Stephen Lee 18 Oct '19

18 Oct '19

Hi, Note: Please do this on a test VM. My issue: I took the output of the following command $ yum list installed | xargs -n3 | column -t | tail -n +3 |cut -d' ' -f1 > packages.list from a CentOS 7.7 Installation. and did $ dnf install $(cat packages.list) --setopt=strict=0 on Freshly installed Minimal CentOS 8 VM. When I reboot I get Failed to switch root: Specified switch root path /sysroot does not seem to be an OS tree. os-release file is missing. What am I doing wrong? packages.list attached thanks --- Thomas Stephen Lee

3 4

Hiding a grub menuentry?
by James Pearson 17 Oct '19

17 Oct '19

Does anyone know if it is possible to 'hide' a grub menuentry with CentOS 7 ? I have a custom menuentry that I don't want to be seen on the grub screen - but it needs to be selectable as the entry to boot via 'grub2-reboot' I've scanned the grub2 documentation - but I can't find anything obvious - so I'm guessing it can't be done - unless someone knows otherwise ? Thanks James Pearson

3 3

vainfo on Intel
by Jerry Geis 17 Oct '19

17 Oct '19

I am trying to get accelerated video on this device NUC5CPYB Intel Driver is loaded: grep Intel Xorg.0.log [ 18.006] (**) | |-->Device "Intel Graphics" [ 18.048] (II) intel: Driver for Intel(R) Integrated Graphics Chipsets: [ 18.051] (II) intel: Driver for Intel(R) HD Graphics [ 18.051] (II) intel: Driver for Intel(R) Iris(TM) Graphics [ 18.051] (II) intel: Driver for Intel(R) Iris(TM) Pro Graphics [ 18.056] (--) intel(0): Integrated Graphics Chipset: Intel(R) HD Graphics [ 18.437] (II) config/udev: Adding input device HDA Intel PCH Front Headphone Surround (/dev/input/event10) [ 18.438] (II) config/udev: Adding input device HDA Intel PCH HDMI/DP,pcm=3 (/dev/input/event11) [ 18.440] (II) config/udev: Adding input device HDA Intel PCH Mic (/dev/input/event8) [ 18.441] (II) config/udev: Adding input device HDA Intel PCH Headphone Front (/dev/input/event9) Vainfo fails: vainfo libva info: VA-API version 0.40.0 libva info: va_getDriverName() returns 0 libva info: Trying to open /usr/lib64/dri/i965_drv_video.so libva info: va_openDriver() returns -1 vaInitialize failed with error code -1 (unknown libva error),exit [root@nuc5cdev2 tmp]# ls /usr/lib64/dri/ i915_dri.so i965_dri.so kms_swrast_dri.so nouveau_dri.so r300_dri.so r600_dri.so radeonsi_dri.so swrast_dri.so virtio_gpu_dri.so vmwgfx_dri.so [root@nuc5cdev2 tmp]# [root@nuc5cdev2 tmp]# yum provides "*/*i965_drv_video.so" Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: ftp.ussg.iu.edu * elrepo: ord.mirror.rackspace.com * epel: ord.mirror.rackspace.com * extras: ftp.ussg.iu.edu * updates: ftp.ussg.iu.edu No matches found So vainfo fails, The file its looking for is not on my system and yum says its not available. What do I do ? Jerry

1 1

DSA key not accepted on CentOS even after enabling
by Gianluca Cecchi 17 Oct '19

17 Oct '19

Hello, I have some users that connect to a server with their DSA key that is of type ssh-dss. I'm migrating (installing as new) the server where they connect to CentOS 8 + updates. I was not able to connect with the keys to this new server even after having added, as found in several internet pages, this directive at the end of /etc/ssh/sshd_config of the CentOS 8 server: # Accept also DSA keys PubkeyAcceptedKeyTypes=+ssh-dss and systemctl restart sshd I kept getting in journal the message: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] I saw that the sshd process had started with the option ... -oPubkeyAcceptedKeyTypes=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com So I found the unit file for sshd that refers to /etc/crypto-policies/back-ends/opensshserver.config In the mean time I was able to reach my target going and editing the /etc/sysconfig/sshd file adding the whole line obtained from the above and adding ssh-dss CRYPTO_POLICY='-oCiphers=aes256-gcm(a)openssh.com, chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com, umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com ,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms= curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com ,ssh-dss' and now it works with pubkey authentication based on DSA keys. Not going to the querelle of OpenSSH 7 removing DSA keys and DSA vs RSA (eg. some considerations by some years ago here: https://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authen… ), any hint on smarter way to add? I suppose further updates could change content of /etc/crypto-policies/back-ends/opensshserver.config that btw is part of crypto-policies-20181217-6.git9a35207.el8.noarch and not openssh-server-7.8p1-4.el8.x86_64 HIH others incurring in this problem and thanks in advance for any insight/hint, Gianluca

2 2

CentOS 7.7 hfs
by Jerry Geis 16 Oct '19

16 Oct '19

I tried to install kmod-hfs and kmod-hfsplus but not found ? What is up ? the system is all updated with yum update. Jerry

1 1

BackupPC v4 from epel
by Ranbir 16 Oct '19

16 Oct '19

Hello Everyone, Has anyone tried to install BackupPC v4 on CentOS 8 from epel? I just did and this happened: [root@resurrect ~]# dnf --enablerepo epel install BackupPC Last metadata expiration check: 0:18:41 ago on Tue 15 Oct 2019 08:03:59 PM EDT. Error: Problem: conflicting requests - nothing provides par2cmdline needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Net::FTP::AutoReconnect) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Net::FTP::RetrHandle) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Time::ParseDate) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(XML::RSS) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl-Time-modules needed by BackupPC-4.3.1-2.el8.x86_64 (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) If that didn't come out too nice, here's a pastebin link: https://pastebin.com/HgjAQmvV I've checked all the disabled repos on my system and none of them have those packages. Is this just a case of the dependencies not being built yet? -- Ranbir

4 3

Attempting to use tproxy on Centos 8 fails with 'No such file or directory'
by Nathan Coulson 16 Oct '19

16 Oct '19

I was working on a haproxy transparent proxy setup that we had working on Centos 7 (iptables), but running into issues getting tproxy working with NFTables on Centos 8. >From https://www.kernel.org/doc/Documentation/networking/tproxy.txt, It should be a matter of: # nft add table filter # nft add chain filter divert "{ type filter hook prerouting priority -150; }" # nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept But when running the 3rd line (add rule), I get root@kryptonite [/lib/modules/4.18.0-80.11.2.el8_0.x86_64]# nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept Error: Could not process rule: No such file or directory add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (In attempting to resolve this, I did the following) modprobe nf_tproxy_ipv4 modprobe nf_tproxy_ipv6 modprobe nf_socket_ipv4 modprobe nf_socket_ipv6 I also noted that: nft add rule filter divert meta l4proto tcp meta mark set 1 accept (Removing socket transparent 1) does not exit with a failure. Also found https://bugzilla.redhat.com/show_bug.cgi?id=1651813, (which did make reference to the nftables version 0.9.0 possibly missing support, I have not tried compiling 0.9.1 yet, but I find it curious the entire line fails with 'socket transparent 1' making me wonder if it is a missing module still) -- Nathan Coulson System Administrator for Bravenet Web Services www.bravenet.com

2 3

easy way to stop old ssl's
by Jerry Geis 15 Oct '19

15 Oct '19

HI all, When CentOS 7 was created things like SSLv2 TLSv1 TLSv1.1 etc... were all OK, but now they have fallen out of favor for various reasons. Updating to CentOS 7.7 does not automatically disable these types of items from apache - is there a script that is available that can be ran to bring a box up to current "accepted" levels ? Or is that an edit by hand, do it yourself on all your boxes or create your own script type of thing. Just checking if there is an easier way. Thanks, Jerry

6 10

Odd issue with 7.7.1908 updated with qemu-kvm-ev
by Lamar Owen 15 Oct '19

15 Oct '19

So, I have a client that has an internal use application that needs an ancient version of libc5. That's not a typo; libc5. Before the server that ran it died about a year and a half ago (said server was an AMD K6-2/450 with a 6GB Western Digital Caviar drive that had been spinning nearly continuously for almost 20 years!) it was running on Red Hat Linux 5.2. The last version of CentOS that shipped with a libc5 was 2.1. So I set them up a KVM guest running CentOS 2.1, mainly because Red Hat 5.2 wouldn't recognize the network at all, using the e1000 network driver, and it ran well. Now, yes, there are no updates, but no it doesn't matter; it's an internal use application that has a very small footprint and very low risk. After the update on the host to 7.7.1908, the network stopped running. The host also has a CentOS 7 guest that is still working properly. If I change the 2.1 system to not automatically load the e1000 driver and console in and 'modprobe e1000' manually, it starts working again, for a while. Any ideas as to where to start looking? qemu-kvm-ev itself, or libvirt? I'm planning to start out with rollbacks to the previous versions of each to try to find where the issue starts.

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss