Discuss

discuss@lists.centos.org

34758 discussions

Ideas for stopping ssh brute force attacks
by Bo Lynch 23 Jul '08

23 Jul '08

just wanted to get some feedback from the community. Over the last few days I have noticed my web server and email box have attempted to ssh'd to using weird names like admin,appuser,nobody,etc.... None of these are valid users. I know that I can block sshd all together with iptables but that will not work for us. I did a little research on google and found programs like sshguard and sshdfilter. Just wanted to know if anyone had any experience with anything like these programs or have any other advice. I really appreciate it. -- Bo Lynch

22 26

NFS V4?
by David Dyer-Bennet 23 Jul '08

23 Jul '08

Looks like just starting the nfs service turns on V2, 3, and 4 (based on reading the script, reading the man pages, and looking at the ports using netstat -l). However, I can connect using -t nfs in the mount, and -t nfs4 fails. I don't believe this is a firewall issue, internal IPs are fully open to each other according to an early rule in iptables. $ sudo mount host03:/home/ddb /mnt/ddb -t nfs4 -o rw,hard,intr mount: permission denied but $ sudo mount host03:/home/ddb /mnt/ddb -t nfs -o rw,hard,intr $ I'm not sure I especially care about NFS V4 (this is to share the programmers' home directories, so it's easy to work on any of the production systems; it won't be particularly high-load or any particularly strange usage pattern), but I care about understanding things at least. Both systems are running Centos 4.6. Any ideas? -- David Dyer-Bennet, dd-b(a)dd-b.net; http://dd-b.net/ Snapshots: http://dd-b.net/dd-b/SnapshotAlbum/data/ Photos: http://dd-b.net/photography/gallery/ Dragaera: http://dragaera.info

4 7

How to get additional packages? How secure is Yum?
by Manuel Reimer 23 Jul '08

23 Jul '08

Hello, I'm coming from Slackware and I'm searching for another distribution to run on my desktop and in near future also on a server. The *top priority* for me is security! I've test-installed CentOS on one of my test systems. So far anything went OK. After trying a bit, I would like to ask some questions: - What is the suggested way to get *secure and trusted* additional packages? I don't want packages packaged by "someone" who doesn't have the required experience and who doesn't do the packaging on a dedicated "build host" which isn't used for anything else than building packages. I tried the Dag-Repository. Seems to be well done and as Dag is member of the CentOS-Staff, I think his packages are trustworthy. Unfortunately I'm unsure if they are secure. For example there is a Drupal package which is *out of date*! So there should either be an update or the package maybe should be removed at all as it is a security hole! Is there a repository available which only has that much packages as the maintainer is able to keep secure? - My second question is about: http://www.cs.arizona.edu/people/justin/packagemanagersecurity/attacks-on-p… Yum also seems to affected, so a malicious mirror would be able to downgrade a package on a server where it's suggested to be *upgraded* to a patched version. When will Yum be fixed and what is the suggested way to get Yum more secure? Thanks in advance for any answers. Yours Manuel -- () ascii ribbon campaign - against html mail /\ - gegen HTML-Mail answers as html mail will be deleted automatically! Antworten als HTML-Mail werden automatisch gelöscht! GMX Kostenlose Spiele: Einfach online spielen und Spaß haben mit Pastry Passion! http://games.entertainment.gmx.net/de/entertainment/games/free/puzzle/61691…

5 6

e-SATA card well supported by Linux (CentOS) with built-in drivers and that supports hot plug
by Filipe Brandenburger 23 Jul '08

23 Jul '08

Hi, I'm looking for a good e-SATA card, preferrently one that is supported by Linux with built-in drivers (no need to compile the modules from the vendor), or at least that the vendor's drivers are packaged with dkms or something similar that makes it easy on kernel upgrades. It's essential that the card supports hot-plugging, because we want to use it to plug backup drives and have them rotated. We are testing one e-SATA drive from LaCie. We tested the Adaptec eSATA II RAID 1225SA, but just to get the module to compile right it was a huge PITA, and we still haven't gotten it to recognize our LaCie drive (we're still not sure why). Instead of spending more time making that s*#t work, I would rather buy another one, but then I would try to get one that works out-of-the box. I don't need that the card supports RAID, it really does not matter to me. Any advice will be much appreciated. Thanks, Filipe

1 0

[Fwd: Re: [CentOS] fail2ban needs shorewall?]
by andylockran 23 Jul '08

23 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've used denyhosts. If you do have an issue with fail2ban, it does pretty much the same thing. Andy - -------- Original Message -------- Subject: Re: [CentOS] fail2ban needs shorewall? Date: Wed, 23 Jul 2008 17:08:07 +0200 From: Kai Schaetzl <maillists(a)conactive.com> Reply-To: CentOS mailing list <centos(a)centos.org> To: centos(a)centos.org References: <VA.000032df.013be7a4(a)news.conactive.com> <200807231353.49975.tony.molloy(a)ul.ie> <VA.000032e0.0165b628(a)news.conactive.com> <200807231453.05336.tony.molloy(a)ul.ie> Tony Molloy wrote on Wed, 23 Jul 2008 14:53:05 +0100: > you can specify noarch on the install > line. that's what I did, I was just curious. Kai - -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkiHX8EACgkQauMjEM4rxIS+OACgkb8cbA7lppmZh0COd4dFS2/W sz8AnRnVnxTpCMCUMOUwyOPF8eKk+bDP =nU4V -----END PGP SIGNATURE-----

2 1

Yum errors
by Scott Silva 23 Jul '08

23 Jul '08

I'm having a problem with a fairly new server. Running yum upgrade I get the following: Traceback (most recent call last): File "/usr/bin/yum", line 29, in ? yummain.main(sys.argv[1:]) File "/usr/share/yum-cli/yummain.py", line 105, in main result, resultmsgs = base.doCommands() File "/usr/share/yum-cli/cli.py", line 289, in doCommands self._getTs() File "/usr/lib/python2.4/site-packages/yum/depsolve.py", line 85, in _getTs self._getTsInfo() File "/usr/lib/python2.4/site-packages/yum/depsolve.py", line 91, in _getTsInfo self._tsInfo.setDatabases(self.rpmdb, self.pkgSack) File "/usr/lib/python2.4/site-packages/yum/__init__.py", line 537, in <lambda> pkgSack = property(fget=lambda self: self._getSacks(), File "/usr/lib/python2.4/site-packages/yum/__init__.py", line 392, in _getSacks self.repos.populateSack(which=repos) File "/usr/lib/python2.4/site-packages/yum/repos.py", line 242, in populateSack sack.populate(repo, mdtype, callback, cacheonly) File "/usr/lib/python2.4/site-packages/yum/yumRepo.py", line 168, in populate dobj = repo_cache_function(xml, csum) File "/usr/lib64/python2.4/site-packages/sqlitecachec.py", line 42, in getPrimary self.repoid)) TypeError: Can not prepare packages insertion: table packages has no column named location_base -- MailScanner is like deodorant... You hope everybody uses it, and you notice quickly if they don't!!!!

4 13

prevent runaway PID taking down server (RAM/swap)
by Ed Donahue 23 Jul '08

23 Jul '08

Is there a way I can prevent processes from taking up all the ram then swap until the box crashes/freezes? I'm using IEs4Linux and the wineserver seems to start taking up RAM until my box dies, it happens slowly. I am able to kill the sucker now, but I'd like to not have to worry about that. sar -r 01:00:01 PM kbmemfree kbmemused %memused kbbuffers kbcached kbswpfree kbswpused %swpused kbswpcad 01:10:01 PM 5812 949580 99.39 5560 67688 189912 1841696 90.65 33300 01:20:01 PM 4736 950656 99.50 4832 119364 0 2031608 100.00 46104 01:30:02 PM 8788 946604 99.08 1004 32360 4 2031604 100.00 10672 01:52:50 PM LINUX RESTART

3 2

Re: [CentOS] Bind Firewall Rules
by Scott Mazur 23 Jul '08

23 Jul '08

On Wed, 23 Jul 2008 12:40:42 -0400, John Hinton wrote > I'm running caching nameservers on almost all of my systems and then > also three nameservers. All are available publicly. I too had hard > coded bind to port 53. I also had specifically opened port 53 > through the firewall. But now, it appears that using only port 53 is > a bad thing. From what I read, both the port and the ID need to > change to be secure > (even this is just security through obscurity). It's sounding like > I'll need to open a port range, but I don't know what a 'good > practice' will be. Port 53 is the dns port used by the world (and your internal private networks) to query your name server. If your name server is intended to provide domain resolution publicly just how do you expect the public to find it if you're randomly changing ports? The world won't port scan your machine until it finds a name server answering on one of them. Dns requests, internal or external, will come into your box on port 53 and there would be no point to running a name server (private, public, caching or otherwise) if this port is not open through the firewall. You've mis-understood the issues of dns security. It would be dangerous to start messing with your firewall rules until you understand exactly how the process works.

2 1

df command reports inaccurate results?
by Sean Carolan 23 Jul '08

23 Jul '08

Can anyone help make sense of this? This is an ext3 partition. It's only showing 403GB out of 426GB used, but then it says only 632MB available? Where'd the extra ~25GB go? [scarolan@server]$ df -H /disks/vrac5 Filesystem Size Used Avail Use% Mounted on /dev/sdb2 426GB 403GB 632MB 100% /disks/vrac5

5 8

fail2ban needs shorewall?
by Kai Schaetzl 23 Jul '08

23 Jul '08

I want to try out fail2ban and notice that both, kbs-CentOS-Testing and ATrpms, have shorewall as a dependency. I do not use shorewall and have never used it. I have my own iptables/firewall script and am happy with it. Can I install shorewall without any ill effects to my current sue of iptables or would I need to use shorewall for firewalling from that point on? (It may be a good product, but I really don't want to learn yet another rule syntax.) Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

2 4

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss