Discuss

discuss@lists.centos.org

34758 discussions

Re: [CentOS] probem with bind???
by David G. Miller 22 Feb '09

22 Feb '09

"fabian dacunha" <fabian(a)baladia.gov.kw> wrote: > Dear All, > > I am sorry for posting this query here but hope someone can help me out > i have been running Centos 5 as my prinamry DNS n Mail server with bind 9.2 > > every thing works fine but in my/var/messages log i see continuosly the > below meesages > > Feb 22 09:14:46 kmdns1 named[2087]: client 62.109.4.89#17222: query > (cache) './NS/IN' denied > Feb 22 09:14:46 kmdns1 named[2087]: client 62.109.4.89#26398: query > (cache) './NS/IN' denied > Feb 22 09:14:51 kmdns1 named[2087]: client 62.109.4.89#65326: query > (cache) './NS/IN' denied > Feb 22 09:14:52 kmdns1 named[2087]: client 62.109.4.89#59870: query > (cache) './NS/IN' denied > > now in my firewall i tryied to block this ip but the messages dont stop > > i also upgraded bind to version bind-9.3.4-6.0.3.P1.el5_2 but no avail > the problem still there > > > i jus like to know whts this problem and how could i solve it > > is there a problem with my DNS server > > thnks and regards > > apprecite your kind help > > > fabian > I run a very small, personal presence on the internet (only a single web site, e-mail, etc. plus DNS for my own stuff) so this might not work if you have lots of sites or there are legitimate reasons why the same source IP address would hit your DNS with multiple, valid queries in a very short period. Typically, once a source IP has queried a DNS, the result is cached for the time to live (TTL) of the resulting record and the query should not normally be repeated. Given this, I added the following rules to my firewall: ... # Block cache poisoning attacks # Drop repeated DNS requests -A RH-Firewall-1-INPUT -p udp -m udp -m recent -i eth0 --dport 53 --update \ --seconds 660 --hitcount 7 --name DNSTHROTTLE --rsource -j DROP -A RH-Firewall-1-INPUT -p udp -m udp -m recent -i eth0 --dport 53 -j ACCEPT \ --set --name DNSTHROTTLE --rsource ... Note that eth0 is my external NIC so these rules only fire for DNS requests that are not from my local network. I came up with seven queries in eleven minutes was a reasonable sign of a cache poisoning attack. Your mileage may very. These two rules replaced about 30 IPs in my blacklist and are completely automatic. The funny this that a lot of the brute force cache poisoning attempts just keep banging away so the source IP stays on the blacklist. Every once in a while I'll see a new IP address hit seven attempts and then the blacklist rule kicks in and they're never heard from again. Cheers, Dave -- Politics, n. Strife of interests masquerading as a contest of principles. -- Ambrose Bierce

1 0

xulrunner dependancy problem
by listmail 22 Feb '09

22 Feb '09

Hi, Is anyone else noticing a problem updating Firefox and its dependencies? It appears that xulrunner-devel 1.9.0.6-1.el5 wants xulrunner 1.9.0.5-1.el5, but "this is not available". Following is the output from Yum when I attempt to update Firefox on CentOS 5.2 X86_64: ============ Resolving Dependencies --> Running transaction check ---> Package firefox.x86_64 0:3.0.6-1.el5.centos set to be updated --> Processing Dependency: xulrunner >= 1.9.0.6-1 for package: firefox ---> Package firefox.i386 0:3.0.6-1.el5.centos set to be updated --> Running transaction check ---> Package xulrunner.x86_64 0:1.9.0.6-1.el5 set to be updated --> Processing Dependency: xulrunner = 1.9.0.5-1.el5 for package: xulrunner-devel --> Processing Dependency: xulrunner = 1.9.0.5-1.el5 for package: xulrunner-devel ---> Package xulrunner.i386 0:1.9.0.6-1.el5 set to be updated --> Running transaction check ---> Package xulrunner-devel.x86_64 0:1.9.0.6-1.el5 set to be updated --> Finished Dependency Resolution Dependencies Resolved ============================================================================= Package Arch Version Repository Size ============================================================================= Updating: firefox x86_64 3.0.6-1.el5.centos updates 12 M firefox i386 3.0.6-1.el5.centos updates 12 M xulrunner x86_64 1.9.0.6-1.el5 updates 10 M xulrunner i386 1.9.0.6-1.el5 updates 9.9 M Updating for dependencies: xulrunner-devel x86_64 1.9.0.6-1.el5 updates 3.6 M Transaction Summary ============================================================================= Install 0 Package(s) Update 5 Package(s) Remove 0 Package(s) Total download size: 48 M Is this ok [y/N]: y Downloading Packages: Running rpm_check_debug ERROR with rpm_check_debug vs depsolve: Package xulrunner-devel needs xulrunner = 1.9.0.5-1.el5, this is not available. Package xulrunner-devel needs xulrunner = 1.9.0.5-1.el5, this is not available. Complete! ======================= Thanks, --Bill

3 3

Software Raid Recovery
by Stephen Leonard Character 21 Feb '09

21 Feb '09

I have a server set up with 4hdd using software raid. I have /boot on a raid1 on md0 , / on raid5 on md1, and swap on raid0 on md2. If one of my drives die, how to I recover? Thanks in advance, scharacter

6 13

Re: [CentOS] CentOS 5 video driver for Intel DG965WHMKR at 1680X1050 resolution?
by Dick Holland 21 Feb '09

21 Feb '09

On Fri, 2009-02-20 at 09:02 +0100, Sorin Srbu wrote: > >-----Original Message----- > >From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf > >Of Dick Holland > >Sent: Friday, February 20, 2009 8:45 AM > >To: CentOS mailing list > >Subject: Re: [CentOS] CentOS 5 video driver for Intel DG965WHMKR at 1680X1050 > >resolution? > > > > > >Be gentle with me, I'm a bit of a noob. Do you mean add rpmforge as a > >yum repository and do a "yum install 915resolution"? > > We all are at some point. ;-) The answer is yes. > > Go here for info on how to add the rpmforge repo: > http://dag.wieers.com/rpm/FAQ.php#B2 > > FYI, RHEL5 i386 reponds to CentOS5 i386 and so on. > > Then do a "yum install whateverpackageyouneed". > > HTH. > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos Thanks for the guidance. I've d/l 915resolution, but it gives me an error message so I've mailed the author as it suggested. I'll post when I get success. -- Dick Holland

1 0

help with alternatives
by Tony Schreiner 20 Feb '09

20 Feb '09

I've installed java-1.6.0-openjdk (from EPEL) on a CentOS 5.2 x86_64 system and see that it has not registered itself with alternatives. First, is there a reason I should know about that it does not set itself up as an alternative? But second, if I was to configure it myself, the syntax is alternatives --install link name path priority ... and other optional stuff Looking at other examples, I'm not clear on the difference between link and path in this command Thanks, Tony Schreiner Boston College

2 2

CentOS-announce Digest, Vol 48, Issue 8
by centos-announce-request＠centos.org 20 Feb '09

20 Feb '09

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2009:0308 Important CentOS 4 ia64 cups - security update (Pasi Pirhonen) 2. CESA-2009:0275 Moderate CentOS 3 ia64 imap - security update (Pasi Pirhonen) 3. CESA-2009:0308 Important CentOS 3 s390(x) cups - security update (Pasi Pirhonen) 4. CESA-2009:0275 Moderate CentOS 3 s390(x) imap - security update (Pasi Pirhonen) 5. CESA-2009:0275 Moderate CentOS 3 i386 imap - security update (Tru Huynh) 6. CESA-2009:0275 Moderate CentOS 3 x86_64 imap - security update (Tru Huynh) 7. CESA-2009:0308 Important CentOS 3 i386 cups - security update (Tru Huynh) 8. CESA-2009:0308 Important CentOS 3 x86_64 cups - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Thu, 19 Feb 2009 20:19:28 +0200 From: Pasi Pirhonen <upi(a)centos.fi> Subject: [CentOS-announce] CESA-2009:0308 Important CentOS 4 ia64 cups - security update To: centos-announce(a)centos.org Message-ID: <20090219181928.GP12358(a)centos.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2009:0308 https://rhn.redhat.com/errata/RHSA-2009-0308.html The following updated files have been uploaded and are currently syncing to the mirrors: ia64: updates/ia64/RPMS/cups-1.1.17-13.3.56.ia64.rpm updates/ia64/RPMS/cups-devel-1.1.17-13.3.56.ia64.rpm updates/ia64/RPMS/cups-libs-1.1.17-13.3.56.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://pasi.pirhonen.eu/ Top-postings silently ignored

1 0

Re: [CentOS] Keepalive...
by John Doe 20 Feb '09

20 Feb '09

> vrrp_instance VI_1 { > state MASTER ### BACKUP on the backup ### > interface eth0 > lvs_sync_daemon_interface eth1 > virtual_router_id 51 > priority 100 ### 99 on the backup ### > advert_int 1 > smtp_alert > virtual_ipaddress { > 192.168.16.123 > } > } Suddenly, I went a bit further... I saw a different (from the outdated doc) config on the web and tried it succesfully: virtual_ipaddress { 192.168.16.123/32 brd 192.168.31.255 scope global } And get these extra bits: Feb 20 16:19:56 lvs1 Keepalived_vrrp: VRRP_Instance(VI_1) Transition to MASTER STATE Feb 20 16:19:57 lvs1 Keepalived_vrrp: VRRP_Instance(VI_1) Entering MASTER STATE Feb 20 16:19:57 lvs1 Keepalived_vrrp: VRRP_Instance(VI_1) setting protocol VIPs. Feb 20 16:19:57 lvs1 Keepalived_vrrp: VRRP_Instance(VI_1) Sending gratuitous ARPs on eth0 for 192.168.16.123 Feb 20 16:19:57 lvs1 Keepalived_vrrp: Remote SMTP server [127.0.0.1:25] connected. Feb 20 16:19:57 lvs1 Keepalived_vrrp: SMTP alert successfully sent. 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:04:23:9e:f3:74 brd ff:ff:ff:ff:ff:ff inet 192.168.28.226/20 brd 192.168.31.255 scope global eth0 inet 192.168.16.123/32 brd 192.168.31.255 scope global eth0 inet6 fe80::204:23ff:fe9e:f374/64 scope link valid_lft forever preferred_lft forever But not sure both lvs are talking vrrp to each other; tcpdump does not intercept anything... JD

1 0

BiND Failover
by Per Qvindesland 20 Feb '09

20 Feb '09

Hi list, I've two servers running the same ldap service. A is primary server and B is simply a mirror, and accounts from server A are constantly synchronized with B. Now I don't have a automatic failover solution, whenever server A goes down, I have to point the domain's A record to server B and wait for the DNS to get updated. Takes quite a lot of time but the ldap service is crucial to the system and shouldn't be down for longer than a few minutes. I've heard about Dyndns? They provide automatic failover if one server does down, what I want to know is if I can do the same using Bind? And if it's possible to do it automatically? Without human intervention. I don't want a round-robin solution, I want a automatic switchover if primary box goes down. Regards Per Qvindesland

5 5

question on hwclock
by Jerry Geis 20 Feb '09

20 Feb '09

I am trying to hwclock to set the time. (hwclock -w) this is what I get on standard 5.2 x86_64. hwclock --debug hwclock from util-linux-2.13-pre7 hwclock: Open of /dev/rtc failed, errno=19: No such device. No usable clock interface found. Cannot access the Hardware Clock via any known method. [root@devcentos5x64 src]# ls -l /dev/rtc crw------- 1 root root 10, 135 Feb 6 13:32 /dev/rtc Any thoughts? Jerry

5 7

Getting "poll: protocol failure in circuit setup" from rsh
by Sorin Srbu 20 Feb '09

20 Feb '09

Hi all, I inherited a cpu-stats script from the previous *nixadmin at our department. This script relies on a rsh-command to get the vmstats from the remote machines and then using a perl script to push it to a web server. Now I've just added a new machine running CentOS 5.2 x64 to the script and I get the error message in the subject line; "poll: protocol failure in circuit setup". What I've done so far is to check whether the command "rsh mach218 uptime" from m2 works with and w/o iptables running on mach218, checking that m2 is allowed to rlogin in m218 hosts.allow, hosts is properly setup, xinetd rsh and rlogin services are on and started AFAICT. In neither case does rsh work when run against m218, I still get the protocol failure-message. I have another machine, m14, that also runs CentOS 5.2 but the x86-flavour, and here rsh works. As far as I can tell, the machines are identically setup with respect to iptables, hosts and hosts.allow. Also the /etc/xinetd.conf are identical on both m14 and m218. Feels like I'm missing something obvious... Can you guys help? Thx. -- BW, Sorin ----------------------------------------------------------- # Sorin Srbu [Sysadmin, Systems Engineer] # Dept of Medicinal Chemistry, Phone: +46 (0)18-4714482 >3 signals> GSM # Div of Org Pharm Chem, Mobile: +46 (0)701-718023 # Box 574, Uppsala University, Fax: +46 (0)18-4714482 # SE-751 23 Uppsala, Sweden Visit: BMC, Husargatan 3, D5:512b # Web: http://www.orgfarm.uu.se ----------------------------------------------------------- # () ASCII ribbon campaign - Against html E-mail # /\ # # MotD follows: # If it wasn't backed-up, then it wasn't important. -The sysadmin's motto.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss