Discuss

discuss@lists.centos.org

34753 discussions

NFS new security requirements?
by Mike Yates 30 Nov '09

30 Nov '09

Hi I've suddenly lost access to some permanent cross-server shares. I think this was following the Nov 5 new kernel, rather than the Centos version upgrade. I don't see any difference to man mount.nfs I have:- [root@hs6 ~]# mount hs8:/data /sysback/hs8-data -v mount: no type was given - I'll assume nfs because of the colon mount: trying 172.26.0.8 prog 100003 vers 3 prot tcp port 2049 mount: trying 172.26.0.8 prog 100005 vers 3 prot udp port 735 mount: hs8:/data failed, reason given by server: Permission denied Yet on hs8 the log shows:- Nov 29 12:47:52 hs8 mountd[2255]: authenticated mount request from 172.26.0.6:617 for /data (/data) No internal permissions have changed. ' Mike Yates MBCS CITP (ISSG) IT Support Engineer Hawkgrove Ltd - Software Systems Design 2, The Business Courtyard, Marl Pits Lane, Trudoxhill, Frome, Somerset, BA11 5DL, UK +44 (0)1373 837900 fax: +44 (0)8700 518155 Registered in England: 2756481 VAT Reg: UK 601 1137 11 Registered Office: NSO Associates LLP, 75 Springfield Road, Chelmsford, Essex CM2 6JB All e-mail is subject to contract and is not intended to create a legally binding agreement. Hawkgrove Ltd will only be bound by an agreement in writing signed by an authorized signatory. All outgoing email is scanned by Kerio, using ClamAV 0.95.1/10094/Mon Nov 30 11:45:20 2009 Known viruses: 660218.

2 1

NetworkManager constantly overwriting /etc/resolve.conf - how to disable?
by Rudi Ahlers 30 Nov '09

30 Nov '09

Hi all, I have a CentOS 5.4 server-only installation, i.e. no X installed, and for some odd reason /etc/resolve.conf gets overwritten by NetworkManager on a constant basis. I haven't been able to track down how often, but I think it's on the hour, or something. This is the conents of the file right now: # Generated by NetworkManager # No nameservers found; try putting DNS servers into your # ifcfg files in /etc/sysconfig/network-scripts like so: # # DNS1=xxx.xxx.xxx.xxx # DNS2=xxx.xxx.xxx.xxx # DOMAIN=lab.foo.com bar.foo.com So, I change it to the following: nameserver 192.168.1.254, save it, and all network functions work fine. But, later on it get's changed again. Running "system-config-network", I can see that the nameserver that I have specified is in there, yet it doesn't show up in /etc/resolve.conf. I have searched a bit on google, but all the results reveal how to use NetworkManager to setup the nameservers, but now how it get's set automatically. Why does this happen, and how do I stop it from happening? -- Kind Regards Rudi Ahlers CEO, SoftDux Hosting Web: http://www.SoftDux.com Office: 087 805 9573 Cell: 082 554 7532

8 13

Bnid Dynamic Update not returnnig latest update
by Joseph L. Casale 30 Nov '09

30 Nov '09

I have a zone that has several hosts update their ip with Dynamic DNS updates. This morning a client had updated its ip, but bind wasn't returning the new ip when queried until I restarted the daemon? Google hasn't yielded anything useful as I am prolly missing the boat with my search criteria. Anyone got any clues/pointers about this issue? Thanks, jlc

2 3

CentOS 5 and DRPM
by Janez Kosmrlj 30 Nov '09

30 Nov '09

Has anybody successfully implemented DRPMs on centos 5.x? I searched the net and I found a few indications that it is possible, but there is very little info how to do it. Just to be clear. With DRPMs i mean deltaRPMs. And with implementation i mean What yum plugins are necessary and what has to be done on the yum repository to make it work. BR Janez

4 8

AIDE or OSSEC on CentOS 5.4 x86_64?
by David McGuffey 30 Nov '09

30 Nov '09

Starting with a fresh load and after I finish hardening the load following the Center for Internet Security (CIS) guidance, I'm wondering whether AIDE or OSSEC would be a better intrusion detection system. I installed AIDE and did a quick test of AIDE and after initializing the db and applying the recent cups update, I found that 1700+ files had changed. Those are a lot of changes to wade through to determine if they are legit or not. If that is all that AIDE can do, then it is not "manageable." Seems to me that any IDS must be tied to the yum update process so that one is not dealing with hundreds/thousands of changes that were brought in by a yum update that I choose to apply. Is OSSEC any less noisy? DaveM

9 11

Best way to secure apache web root
by Stephen Nelson-Smith 30 Nov '09

30 Nov '09

I have a site running drupal. The apache user therefore needs to be able to write certain files (CSS files for example). I also have a directory under my web root which is a SAN mount, to which apache must be able to write. What is the most secure way to implement this? I am thinking: chown -R root:apache /var/www/html chmod -R 0750 /var/www/html chown apache:apache for where need to write Is there a better way? S.

4 4

startssl and CA autority
by fakessh 29 Nov '09

29 Nov '09

> hi all > > hi postfix list > > I worked all day to develop my certificates > with certificates free of startssl > > I based this document > http://translate.google.fr/translate?js=y&prev=_t&hl=fr&ie=UTF-8&u=http%3A%… > > I realized correctly signed certificates > > I read in the doc startssl the need to import this document among the > certificates > to import the document https://www.startssl.com/certs/sub.class1.client.ca.pem > > how to incorporate the certificates in postfix? > > > thanks for all your feedback > > thanks all your > > thanks >

2 1

again, nic driver order
by Gordon McLellan 29 Nov '09

29 Nov '09

I have two servers with identical hardware ... TYAN i3210w system boards with dual intel gigabit interfaces, and a PCI intel gigabit nic. I'm running Centos 5.4, x86_64, 2.6.18-164.6.1.el5 Every other time I reboot, the nics initialize in a different order. anaconda had setup /etc/modprobe.conf with alias lines for the cards: alias eth0 e1000 alias eth1 e1000e alias eth2 e1000e However, introducing the bonding driver into the mix seems to have thrown a wrench in the works. alias bond0 bonding options bond0 miimon=80 mode=5 #or something like that, can't get to the machine right now - no console and the network is down So, I read about the ifcfg options and try assigning each config script an HWADDR line. after rebooting, /var/log/messages announces that hardware address for eth1 does not match, skipping ... same for eth2 Reading the archives seems to indicate modprobe.conf doesn't do much and is made obsolete by udev, and that hwaddr is discouraged because it's a band-aid. The archives seem to suggest fiddling with udev to be the answer. So I modify /etc/udev/rules.d/60-net (or something) and add a few rules found in an ancient example (those aren't my mac addresses): KERNEL=="eth?", SYSFS{address}=="00:37:e9:17:64:af", NAME="eth0" # MAC of first NIC in lowercase KERNEL=="eth?", SYSFS{address}=="00:21:e9:17:64:b5", NAME="eth1" # MAC of second NIC in lowercase Now, all three network cards get assigned as eth0! eth1 and eth2 are no longer found. The pci-express nics (onboard) get detected first, and the pci nic is last, so it ends up "owning" the eth0 alias. I don't really care which alias gets assigned to which nic, but I want that assignment to be constant. All suggestions are appreciated! Gordon

6 17

CentOS-announce Digest, Vol 57, Issue 12
by centos-announce-request＠centos.org 28 Nov '09

28 Nov '09

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2009:1601 Critical CentOS 5 x86_64 kdelibs Update (Karanbir Singh) 2. CESA-2009:1601 Critical CentOS 5 i386 kdelibs Update (Karanbir Singh) 3. CEBA-2009:1600 CentOS 5 x86_64 kexec-tools Update (Karanbir Singh) 4. CEBA-2009:1600 CentOS 5 i386 kexec-tools Update (Karanbir Singh) 5. CEBA-2009:1613 CentOS 5 i386 system-config-lvm Update (Karanbir Singh) 6. CEBA-2009:1613 CentOS 5 x86_64 system-config-lvm Update (Karanbir Singh) 7. CEBA-2009:1612 CentOS 5 x86_64 openswan Update (Karanbir Singh) 8. CEBA-2009:1612 CentOS 5 i386 openswan Update (Karanbir Singh) 9. CEBA-2009:1611 CentOS 5 i386 xterm Update (Karanbir Singh) 10. CEBA-2009:1611 CentOS 5 x86_64 xterm Update (Karanbir Singh) 11. CEBA-2009:1610 CentOS 5 i386 metacity Update (Karanbir Singh) 12. CEBA-2009:1610 CentOS 5 x86_64 metacity Update (Karanbir Singh) ---------------------------------------------------------------------- Message: 1 Date: Fri, 27 Nov 2009 23:09:54 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CESA-2009:1601 Critical CentOS 5 x86_64 kdelibs Update To: centos-announce(a)centos.org Message-ID: <20091127230954.GA20939(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2009:1601 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2009-1601.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: 25503455a83968e82bddb5bad50b3b36 kdelibs-3.5.4-25.el5.centos.1.i386.rpm 24abb566a75e1186b8cc47ac3b883808 kdelibs-3.5.4-25.el5.centos.1.x86_64.rpm 4f29862576be6cd8f777c3fa02b39b6f kdelibs-apidocs-3.5.4-25.el5.centos.1.x86_64.rpm ef5c485ca5cd72aac5f4d11015a2d946 kdelibs-devel-3.5.4-25.el5.centos.1.i386.rpm a6ec2f3c18bb9f659f847058411d4c1b kdelibs-devel-3.5.4-25.el5.centos.1.x86_64.rpm Source: 0916c7381c048924207a81a0b0e9bde9 kdelibs-3.5.4-25.el5.centos.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Fri, 27 Nov 2009 23:09:53 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CESA-2009:1601 Critical CentOS 5 i386 kdelibs Update To: centos-announce(a)centos.org Message-ID: <20091127230953.GA20924(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2009:1601 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2009-1601.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: 69f420e91ae49efb936b7ac6bafc4447 kdelibs-3.5.4-25.el5.centos.1.i386.rpm 9e10d4c1ba5770f61a9a415d302663f7 kdelibs-apidocs-3.5.4-25.el5.centos.1.i386.rpm 2d16f3725afc68fd2256b2d0b62426bb kdelibs-devel-3.5.4-25.el5.centos.1.i386.rpm Source: 0916c7381c048924207a81a0b0e9bde9 kdelibs-3.5.4-25.el5.centos.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Fri, 27 Nov 2009 23:11:16 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1600 CentOS 5 x86_64 kexec-tools Update To: centos-announce(a)centos.org Message-ID: <20091127231116.GA21015(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1600 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1600.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: 2b21645feba164d62f646dc3eeeb4a06 kexec-tools-1.102pre-77.el5.3.x86_64.rpm Source: b206ef6a6023af19bb1cc6ae2d0846bc kexec-tools-1.102pre-77.el5.3.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Fri, 27 Nov 2009 23:11:16 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1600 CentOS 5 i386 kexec-tools Update To: centos-announce(a)centos.org Message-ID: <20091127231116.GA21000(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1600 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1600.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: 01fb1c1596d2f18e3922d9d1bf2c3c0c kexec-tools-1.102pre-77.el5.3.i386.rpm Source: b206ef6a6023af19bb1cc6ae2d0846bc kexec-tools-1.102pre-77.el5.3.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 5 Date: Fri, 27 Nov 2009 23:13:45 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1613 CentOS 5 i386 system-config-lvm Update To: centos-announce(a)centos.org Message-ID: <20091127231345.GA21084(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1613 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1613.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: e6335c49b8f3329e402e5d3e53611897 system-config-lvm-1.1.5-1.0.el5_4.1.noarch.rpm Source: 67fda636e8f41adcdf9d8f1fb7caea57 system-config-lvm-1.1.5-1.0.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 6 Date: Fri, 27 Nov 2009 23:13:45 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1613 CentOS 5 x86_64 system-config-lvm Update To: centos-announce(a)centos.org Message-ID: <20091127231345.GA21099(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1613 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1613.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: 292e68d92156b38cc296d6043b2f0215 system-config-lvm-1.1.5-1.0.el5_4.1.noarch.rpm Source: 67fda636e8f41adcdf9d8f1fb7caea57 system-config-lvm-1.1.5-1.0.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 7 Date: Fri, 27 Nov 2009 23:17:10 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1612 CentOS 5 x86_64 openswan Update To: centos-announce(a)centos.org Message-ID: <20091127231710.GA21199(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1612 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1612.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: c2888e684a30c8f7f015256fb8a7bba6 openswan-2.6.21-5.el5_4.1.x86_64.rpm f04a532ddf2eb134b597a775f7bdfc24 openswan-doc-2.6.21-5.el5_4.1.x86_64.rpm Source: 0942317900c4fa0065bd295efab6e0e4 openswan-2.6.21-5.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 8 Date: Fri, 27 Nov 2009 23:17:09 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1612 CentOS 5 i386 openswan Update To: centos-announce(a)centos.org Message-ID: <20091127231709.GA21184(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1612 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1612.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: c520e1798d11cd5ac40ae47cce9fa1a5 openswan-2.6.21-5.el5_4.1.i386.rpm d38b53762fea5d27a8ae40b8e2d28768 openswan-doc-2.6.21-5.el5_4.1.i386.rpm Source: 0942317900c4fa0065bd295efab6e0e4 openswan-2.6.21-5.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 9 Date: Fri, 27 Nov 2009 23:18:27 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1611 CentOS 5 i386 xterm Update To: centos-announce(a)centos.org Message-ID: <20091127231827.GA21261(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1611 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1611.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: eb5d68779ddaecc22ddb519d83915979 xterm-215-8.el5_4.1.i386.rpm Source: 67b24109810ef1fe0a2fd0b5b31cc20a xterm-215-8.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 10 Date: Fri, 27 Nov 2009 23:18:27 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1611 CentOS 5 x86_64 xterm Update To: centos-announce(a)centos.org Message-ID: <20091127231827.GA21276(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1611 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1611.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: be2bf3c90ab6ea34ebe31351da16f78d xterm-215-8.el5_4.1.x86_64.rpm Source: 67b24109810ef1fe0a2fd0b5b31cc20a xterm-215-8.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 11 Date: Fri, 27 Nov 2009 23:20:30 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1610 CentOS 5 i386 metacity Update To: centos-announce(a)centos.org Message-ID: <20091127232030.GA21345(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1610 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1610.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) i386: bc0cb5c70d74cf7a6965afc0dce1d53e metacity-2.16.0-12.el5_4.1.i386.rpm Source: cbef78606a3defef84614ba90e757df4 metacity-2.16.0-12.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ Message: 12 Date: Fri, 27 Nov 2009 23:20:30 +0000 From: Karanbir Singh <kbsingh(a)centos.org> Subject: [CentOS-announce] CEBA-2009:1610 CentOS 5 x86_64 metacity Update To: centos-announce(a)centos.org Message-ID: <20091127232030.GA21360(a)tantra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2009:1610 Upstream details at : https://rhn.redhat.com/errata/RHBA-2009-1610.html The following updated files have been uploaded and are currently syncing to the mirrors: ( md5sum Filename ) x86_64: a62304689380340ad45682704f2cbdd6 metacity-2.16.0-12.el5_4.1.i386.rpm 43f8ba25d93dd969d7bc7c5aa82093e8 metacity-2.16.0-12.el5_4.1.x86_64.rpm Source: cbef78606a3defef84614ba90e757df4 metacity-2.16.0-12.el5_4.1.src.rpm -- Karanbir Singh CentOS Project { http://www.centos.org/ } irc: z00dax, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 57, Issue 12 ***********************************************

1 0

SNAT question
by Peter Peltonen 28 Nov '09

28 Nov '09

Hi, I am unable to get my LAN masqueraded using SNAT with CentOS 5.3 and iptables. I have the following setup: eth0: connects to internet with static public IP 1.2.3.1 (obscured here for privacy) eth1: connects to DMZ with static public IP 1.2.3.2 (obscured here for privacy) eth2: connects to LAN with static private IP 192.168.0.1 Traffic to hosts in the DMZ/Internet through eth0/1 work fine. I tried masqueradig the LAN with following: ptables -A FORWARD -i eth2 -j ACCEPT iptables -A FORWARD -o eth2 -j ACCEPT iptables -A POSTROUTING -t nat -s 192.168.0.0/24 -o eth0 -j SNAT --to-source 1.2.3.1 After this I can ssh to a server in the Internet from the LAN using the server's IP address but not its name. The w command on the server tells me that my address has not been masqueraded (its 192.168.0.2, the LAN client's private IP). What am I doing wrong? Best, Peter

3 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss