Discuss

discuss@lists.centos.org

34753 discussions

Cebit and Centos
by Didi 07 Oct '08

07 Oct '08

Hey I just read this http://www.linux-magazine.com/online/news/cebit_open_source_linux_magazine_… Maybe Centos want's to try to get a stand. Cheers Didi ---- www.ribalba.de Email / Jabber: ribalba(a)gmail.com Skype : ribalba

6 8

Customizing SELinux Policy
by Alain Reguera Delgado 07 Oct '08

07 Oct '08

Hi Guys, After some moths the server has been running in SELinux Permesive mode ... Some avc: denied messages has been recored ... I thought it was time to go to the next step and set SELinux Enforcing mode in the server ... it is a mail(postfix+cyrus+sasl), web, snmp with mrtg, squid sever with a local TLS configured for webmail access ... I took a look to the Deployment Guide about how to do it ... and tried to build modules with audit2allow from the /var/log/message The modules seem to work fine, because old avc denied messages desappeard ... but some messages like the following appear at /var/log/messages when I do a semodule -i modulename or semodule -r modulename : Oct 5 20:16:11 orion kernel: : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)' Oct 5 20:16:11 orion kernel: audit(1223252171.572:8): policy loaded auid=4294967295 ses=4294967295 Oct 5 20:16:41 orion kernel: audit(1223252201.673:9): user pid=2172 uid=81 auid=4294967295 subj=system_u:system_r:system_dbus d_t:s0 msg='avc: received policyload notice (seqno=3) Oct 5 20:16:41 orion kernel: : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)' Oct 5 20:16:41 orion kernel: audit(1223252201.676:10): policy loaded auid=4294967295 ses=4294967295 Oct 5 20:17:51 orion kernel: audit(1223252271.462:11): user pid=2172 uid=81 auid=4294967295 subj=system_u:system_r:system_dbu sd_t:s0 msg='avc: received policyload notice (seqno=4) Oct 5 20:17:51 orion kernel: : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)' Oct 5 20:17:51 orion kernel: audit(1223252271.464:12): policy loaded auid=4294967295 ses=4294967295 Oct 5 20:19:06 orion kernel: audit(1223252346.208:13): user pid=2172 uid=81 auid=4294967295 subj=system_u:system_r:system_dbu sd_t:s0 msg='avc: received policyload notice (seqno=5) Oct 5 20:19:06 orion kernel: : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)' Oct 5 20:19:06 orion kernel: audit(1223252346.211:14): policy loaded auid=4294967295 ses=4294967295 Oct 5 20:19:11 orion kernel: audit(1223252351.331:15): user pid=2172 uid=81 auid=4294967295 subj=system_u:system_r:system_dbu sd_t:s0 msg='avc: received policyload notice (seqno=6) Also, in the /var/log/httpd/ssl_error_log the following messages appear too: [Sun Oct 05 19:58:19 2008] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Sun Oct 05 19:58:19 2008] [warn] RSA server certificate CommonName (CN) `orion.ciget.cienfuegos.cu' does NOT match server nam e!? Really rare to me because that name `orion.ciget.cienfuegos.cu' is the actual server hostname. When try to connect to the webmail through https:// can't connect to it, the browser reports connection failed after a waiting of a few seconds. http:// works as expected. This machine is fully updated in CentOS-5.2. Linux orion.ciget.cienfuegos.cu 2.6.18-92.1.13.el5 #1 SMP Wed Sep 24 19:33:52 EDT 2008 i686 i686 i386 GNU/Linux Could you suggest something ? ... Thank you very much guys, al.

1 1

CentOS-announce Digest, Vol 44, Issue 5
by centos-announce-request＠centos.org 07 Oct '08

07 Oct '08

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2008:0908 Moderate CentOS 4 s390(x) thunderbird - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 6 Oct 2008 18:44:07 +0300 From: Pasi Pirhonen <upi(a)centos.fi> Subject: [CentOS-announce] CESA-2008:0908 Moderate CentOS 4 s390(x) thunderbird - security update To: centos-announce(a)centos.org Message-ID: <20081006154407.GD5793(a)centos.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2008:0908 https://rhn.redhat.com/errata/RHSA-2008-0908.html The following updated files have been uploaded and are currently syncing to the mirrors: s390: updates/s390/RPMS/thunderbird-1.5.0.12-16.el4.centos.s390.rpm s390x: updates/s390x/RPMS/thunderbird-1.5.0.12-16.el4.centos.s390x.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://pasi.pirhonen.eu/ Top-postings silently ignored

1 0

problem talking to server postgrey/socket: Permission denied
by Dirk H. Schulz 07 Oct '08

07 Oct '08

Hi folks, I have installed postgrey from the rpmforge repo, but it does not work well with postfix from CentOS 5.2: I always get the error: warning: connect to postgrey/socket: Permission denied problem talking to server postgrey/socket: Permission denied But the permissions on the socket seem okay (postfix could write to it): srw-rw-rw- 1 postgrey postgrey 0 4. Okt 14:48 socket I also tried "restorecon -R /var/spool/postfix/postgrey", but that did not change anything, either. Googling does not show anything recent and helpful. Any hint or help is appreciated. Dirk

3 4

vsftpd
by Mad Unix 07 Oct '08

07 Oct '08

Hi ALL I'm using vsftpd as FTP server, and I'd like to chroot my FTP users to their home dir. How can I do it? i.e. "jailing" them in their home dir... at the moment I have the following issues the user when they login to ftp server they go to the main directory /var/ftp/ /etc/passwd ... sdc:x:501:501::/var/ftp/sdc:/bin/bash ase:x:502:501::/var/ftp/ase:/bin/bash jsc:x:503:501::/var/ftp/jsc/:/bin/bash [root@linux10 ftp]# pwd /var/ftp [root@linux10 ftp]# ls -al total 28 drwx--x--x 6 root ftpusers 4096 Oct 6 13:46 . drwxr-xr-x 22 root root 4096 Oct 5 15:42 .. drwx------ 3 ase ftpusers 4096 Oct 6 20:30 ase drwx------ 3 jsc ftpusers 4096 Oct 6 17:27 jsc drwx------ 2 pons pons 4096 Oct 6 16:22 pub drwx------ 5 sdc ftpusers 4096 Oct 6 17:19 sdc chroot_list_enable=YES # (default follows) chroot_list_file=/etc/vsftpd/chroot_list chroot_local_user=YES # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6 # sockets, you must run two copies of vsftpd whith two configuration files. # Make sure, that one of the listen options is commented !! #listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES ###added for TLSand SSL permission ssl_enable=YES allow_anon_ssl=NO force_local_data_ssl=NO force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=YES ssl_sslv3=YES rsa_cert_file=/etc/vsftpd/vsftpd.pem rsa_private_key_file=/etc/vsftpd/vsftpd.pem local_root=/var/ftp #userlist_file=/etc/vsftpd/ftpusers userlist_file=/etc/vsftpd/ftpusers #userlist_file=/etc/vsftpd/user_list pasv_enable=YES anon_max_rate=10485760 local_max_rate=0 max_clients=500 max_per_ip=4 passwd_chroot_enable=YES

1 0

Re: [CentOS] Re: mysqld breaks yum, help?
by Vandaman 07 Oct '08

07 Oct '08

Dac Chartrand wrote: > Yum is broken. > I have the priorities plug-in setup. I did `yum update` before > messing around with 3rd party repositories. The only modules I > installed from the 3rd party sties are PHP related. Isn't there php in the CentOS plus repo? What repo is that you messed about with? ATRPMS or Livna? Regards, Vandaman.

11 29

Eclipse 3.2.1-19 package on Centos 5.2
by Tom [toms400] 06 Oct '08

06 Oct '08

Hi, I'm using Centos 5.2 and trying to use Eclipse's embedded browser without success. Could this be due to any of the patches that were commented out in 3.2.1-18? When trying to use the embedded browser, I get the error: No more handles (java.lang.UnsatisfiedLinkError: no swt-mozilla-gtk-3235 in java.library.path). I have a gre.conf, have set MOZILLA_FIVE_HOME, and LD_LIBRARY_PATH, but continue to get that error. If you have any ideas, I'd be very grateful. Thanks -Tom

2 1

Re: OT: RIP settings for private netblocks
by James B. Byrne 06 Oct '08

06 Oct '08

James B. Byrne wrote: > You can accomplish this much easier by simply using > a firewall. I like OpenBSD firewalls in layer 2 > bridging mode. Put the firewall in-line between the > router and the rest of the network, no other network > changes needed. The difficulty with this is that it requires yet another host, a reconfiguration of the existing wiring plan, and dealing with a number of other issues which directly arise from the first two requirements. We already use IPtables, and we already have some of our older hosts secured behind sshd linux boxes so that network traffic to them is only carried en clair across direct x-wired patch cables. > If your not well versed in routing I wouldn't recommend > going around making a bunch of changes to a system that > I assume has been more or less working for more than > a decade. Which is why I asked the question if by making a single change to the network parameter of the Cisco Router could I avoid: 1. Physically segmenting my LAN 2. Having to commission an additional host or reconfigure an existing host to multi-homed. Routing is something I do not go at very often and I do not trust my memory for such things in consequence. The manuals and books that I have give sketchy coverage of this aspect and use examples much more narrow in scope than I contemplate. It would be a gross over-statement to say that I am unfamiliar with the concepts of routing. But I am asking for specific guidance on specific software (CISCO ISO 12.x) and hardware (CISCO 26xx series) from someone with experience in these matters. I recognize that this is not the precise forum to ask, thus the OT. On the other hand, I trust that my situation cannot be very dissimilar to those faced previously by many system administrators who also happen to run CentOS. Regards, -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

OT: RIP settings for private netblocks
by James B. Byrne 06 Oct '08

06 Oct '08

I am contemplating converting some of our internal networks from routable to private IPv4 address space. I have a question about RIP as implemented under Cisco IOS 12.x. Presently the setting for rip is: router rip version 2 passive-interface [[FastEthernet]]0/0 network aaa.bbb.ccc.0 no auto-summary What I would like to know is how one routes the entire 192.168/16 address space using rip. My perusal of the various Cisco manuals, technical documents and various O'Rielly books is not giving me any clear answer and I am rather reluctant to experiment on our live Internet connection. Will this do what I imagine it might, treat any address 192.168.x.y or 10.x.y.z as an internal network? router rip version 2 passive-interface [[FastEthernet]]0/0 network aaa.bbb.ccc.0 network 192.168.0.0 network 10.0.0.0 no auto-summary Regards, -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 4

need ur kind advice
by fabian dacunha 06 Oct '08

06 Oct '08

Dear All, apprecite ur kind help n advice I have a Centos 5 server running only squid for sometime and its workin great. i am concerned about security so i have a shorewall firewall on the machine runnign squid n works grt now i would like to know the follwing 1) does anyone one know of any good antivirus software i could install on the centos OS squid server so as to scan for viruses so i cd periodically scan the server thnks and apprecite regards fabian -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss