Discuss

discuss@lists.centos.org

34753 discussions

/etc/ldap.conf pam_filter
by Nobody ist perfect 11 Feb '10

11 Feb '10

Hi, we use an openldap server / samba as domain controller for our windows/linux workstations. on a specific server, login should only be allowed, if the certain user is member of a group (let's call this group "login"). All the users in the domain are members of the group "Domain Users". Therefore their primary gid is not the login-group's gid. How can I make the login depending on that login-group-membership? Thanks! Toby

3 3

Experiencing continual eth0 link up/down on a 10G Chelsio NIC (cxgb3 driver)
by Arun Khan 11 Feb '10

11 Feb '10

File Server OS: CentOS 5.3 (x86_64) Kernel: CentOS Plus kernel (need XFS fs drivers) The file server has a Chelsio T310 10GBASE-CX4 RNIC (rev 3) PCI Express x8 MSI-X (eth0), driver and firmware is stock from the CentOS Plus kernel. Using ethtool I have verified driver association with the 3 NICs on the system (eth1 and eth2 are not connected to any switch) Driver for eth0 driver: cxgb3 version: 1.1.3-ko firmware-version: T 7.4.0 TP 1.1.0 Driver for eth1 driver: e1000e version: 1.0.2-k2 firmware-version: 1.0-0 Driver for eth2 driver: e1000e version: 1.0.2-k2 firmware-version: 1.0-0 The last 3-4 weeks, I have noticed that the eth0 link keeps going up and down, confirmed by "dmesg" output as well in /var/log/messages (dmesg sample shown below). eth0: link down eth0: link up, 10Gbps, full-duplex eth0: link down eth0: link up, 10Gbps, full-duplex eth0: link down eth0: link up, 10Gbps, full-duplex The kernel RPM verification shows no errors # uname --kernel-release 2.6.18-164.2.1.el5.plus # rpm --verify kernel-2.6.18-164.2.1.el5.plus The hardware vendor tells me that the card either fails completely (kaput) or works - there is no grey area. He is of the opinion that the problem is with the driver. Verification of the kernel rpm tells me that all files including the cxgb3 driver file md5sum are OK. I would like to hear from anyone with the same NIC or another rev. using the same driver. Are you seeing similar link up/down in your system? How did you solve the problem? TIA -- Arun Khan

3 4

how to work with Code Repositories, but for web development?
by Rudi Ahlers 11 Feb '10

11 Feb '10

Hi all, I would like some suggestion on this matter please. I have never bothered using any code repositories / version control systems for our web development project, many cause I didn't know any better, and probably cause most of our projects don't really require that we need to keep a history of what has changed. i.e. a client wants to change something on their website, and we change it, whether it's cosmetics or code (normally PHP & MySQL). But, I want to see if CVS, or maybe even a forge script (like in offerforge) could benefit met. Most of the time when we make changes to the code, we simply update the version, from say 1.2.2 to 1.2.3 and write the changes to a basic changelog, which in our case is a simple text file calles changelog.txt But, how could I benefit from a CVS, ir similar system? And what would be best for this environment? I installed CVS on my CentOS server, but it seems that it's not just a matter of creating a tree and dumping code. I'm not too worried about multiple users at this stage. All our coding is currently stored on a CentOS 5.4 Samba server, so we can access to the code from either a Windows or Linux PC. Do I need anything more? I started using eclipse+PHP a few months ago and I don't really use it to its full potential, so I'm sure I could benefit from it more. So, the question is, what is a good recommended setup to go with? Web based access to all the files would be nice, then we could access it from outside the LAN on HTTPS. And how do I use it to my benefit? For example, clientA wants to make changes to Project1. Now I have a Project1 in the CVS tree (is this the right terminology?), and make changes to file contacts.php - what now? Do I need to create a subfolder called 1.2.2 (for example), and add only the updated file in this folder, or do I copy the whole Project into the new folder? 2 weeks down the line I need to make changes to 8 files, what do I do now? Does this make sense? I realize it could be beneficial to keep older files, but how does one structure it? -- Kind Regards Rudi Ahlers SoftDux Website: http://www.SoftDux.com Technical Blog: http://Blog.SoftDux.com Office: 087 805 9573 Cell: 082 554 7532

10 13

CentOS 5.4 x86_64 authenticating against AD (Server 2008r2)
by Dan Burkland 11 Feb '10

11 Feb '10

Hey All, Just wondering if any of you have been able to setup CentOS 5.4 to authenticate against AD on a Server 2008r2 Domain Controller. I am trying to complete this particular setup however I have run into some difficulties such as not being able to lookup domain users via getent passwd. Thanks for your input, Dan

8 21

saslauthd attack
by John Hinton 11 Feb '10

11 Feb '10

I'm seeing a lot of activity over the last two days with what looks to be a kiddie script. Mostly trying to access several of our servers with the username anna. All failed... in fact I don't think we have a user anna on any of our servers. Meanwhile... I'm running Sendmail. This pertains to Centos 4 and 5 servers. I'm also running fail2ban on some and Ossec on others. So far, no blocking is being done. When I look at the logs all I find is under messages and here is a sample: Feb 10 05:23:08 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 05:23:25 neptune saslauthd[3369]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 05:23:58 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:53 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:54 neptune saslauthd[3368]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:55 neptune saslauthd[3370]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] Feb 10 06:56:59 neptune saslauthd[3368]: do_auth : auth failure: [user=anna] [service=smtp] [realm=] [mech=shadow] [reason=Unknown] So, I can't write a rule to block this attack as I can't find any IP address to block. I've looked and googled til my eyes are red and can't find where to set logging in saslauthd or where ever it needs to be set to record the IP address generating these failures. Does anyone have an idea? Also, some may wish to do a grep 'do_auth' on messages to see if this is happening to you. They sometimes come in rapid succession. John Hinton

5 6

Syslog for chroot-jailed SFTP users?
by Sean Carolan 11 Feb '10

11 Feb '10

Maybe one of you can help. We have set up a CentOS server so that each user who logs in via sftp will be jailed in their home directory. Here's the relevant sshd_config: # override default of no subsystems Subsystem sftp internal-sftp -f LOCAL2 -l INFO Match Group sftponly ChrootDirectory /home/%u ForceCommand internal-sftp This actually works great, but none of the activities of sftponly group members is getting logged. The man page for sftp-server says: "For logging to work, sftp-server must be able to access /dev/log. Use of sftp-server in a chroot configuation therefore requires that syslogd(8) establish a logging socket inside the chroot directory." How do I establish a logging socket inside the chroot directory, when the chroot directory is different depending on which user is logging in at any given time? I don't want to run separate sockets in every customer's chroot directory, this is not practical. Any ideas?

3 5

Re: [CentOS] saslauthd attack
by Les Bell 11 Feb '10

11 Feb '10

John Hinton wrote: >> Yes... most of them. Just the new PITA. Anyway... I still can't seem to figure out how to log the IP addresses for this attack. << I'd use iptables to log connections on that port and then time-correlate with the log entries from saslauthd. Best, --- Les Bell [http://www.lesbell.com.au] Tel: +61 2 9451 1144

1 0

CentOS-announce Digest, Vol 60, Issue 2
by centos-announce-request＠centos.org 10 Feb '10

10 Feb '10

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2010:0088 Important CentOS 5 x86_64 kvm Update (Karanbir Singh) 2. CESA-2010:0094 Critical CentOS 4 i386 HelixPlayer - security update (Tru Huynh) 3. CESA-2010:0094 Critical CentOS 4 x86_64 HelixPlayer - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Feb 2010 13:51:39 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CESA-2010:0088 Important CentOS 5 x86_64 kvm Update To: centos-announce(a)centos.org Message-ID: <20100209135139.GA22305(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2010:0088 Important Upstream details at : http://rhn.redhat.com/errata/RHSA-2010-0088.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: 79704ae0e59d7ca2c76c96e087fe94b7 kmod-kvm-83-105.el5_4.22.x86_64.rpm 1e848a0873b1d28fe87945202e8ea483 kvm-83-105.el5_4.22.x86_64.rpm be5796fe492fcb764c5ffd0b662298ba kvm-qemu-img-83-105.el5_4.22.x86_64.rpm ca27435ea4a07209579fc9518901a2c7 kvm-tools-83-105.el5_4.22.x86_64.rpm Source: f5b9b0b74caf41a66786f047cb2e17e8 kvm-83-105.el5_4.22.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Tue, 9 Feb 2010 18:22:40 +0100 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2010:0094 Critical CentOS 4 i386 HelixPlayer - security update To: centos-announce(a)centos.org Message-ID: <20100209172240.GA13104(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2010:0094 HelixPlayer security update for CentOS 4 i386: https://rhn.redhat.com/errata/RHSA-2010-0094.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/HelixPlayer-1.0.6-1.el4_8.1.i386.rpm source: updates/SRPMS/HelixPlayer-1.0.6-1.el4_8.1.src.rpm You may update your CentOS-4 i386 installations by running the command: yum update HelixPlayer Tru -- Tru Huynh (mirrors, CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

sendmail mail relay backscatter issue.
by Simon Billis 10 Feb '10

10 Feb '10

Hi Folks, I have a couple of questions which I hope that you will be able to assist with, first some background. I run a few sendmail servers that run MailScanner/Spamassassin/sendmail (current versions) on Centos 5.4 and Centos 4.8 These boxes accept mail for a large number of domains (6000+) scan the mail removing spam and then forward the ham to another server for delivery. I am attempting to stop any backscatter that these servers cause by only accepting mail for specific users@domain or for domains with a catch-all account. I currently use /etc/mail/access.db as the access map for the domains, but this allows all mail to be accepted for the domain before the attempting to send it on for final delivery which causes NDR and backscatter for those domains which do not have a catch-all account. I have looked at adding "To:user@domain RELAY" to the access map and also adding "define(`_RELAY_FULL_ADDR_', `1') " in the sendmail.mc and running make -C /etc/mail but this has no effect on the sendmail.cf file. My understanding is that if I can get sendmail to accept this undocumented feature then all will be fine as I will be able to use the access map to allow mail to those specific users as well as entries of the type "domain RELAY". My first question is: Does anyone have any ideas as to why I wouldn't be able to have this change reflected in sendmail.cf? My second question is: Does anyone have any ideas on how to utilise access map and relay-domains to achieve the same thing? Thanks for your time and assistance. Simon.

4 23

Re: [CentOS] R package on centos 5.1
by Les Bell 10 Feb '10

10 Feb '10

hersh parikh <hershparikh12(a)yahoo.com> wrote: >> I want to install R package on centos 5.1, however I am not able to install it << I'm running it here on Centos 5.4. What problem are you having? Error messages? Best, --- Les Bell [http://www.lesbell.com.au] Tel: +61 2 9451 1144

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss