Discuss

discuss@lists.centos.org

5 participants
34752 discussions

modules maintenance
by Valere Binet 09 Aug '22

09 Aug '22

Hi, Are the default modules receiving security update? Security tools (Tenable) want me to update PHP to 7.4 claiming 7.2.24-1.module_el8.2.0+313+b04d0a66 has several vulnerabilities per CESA-2021:4213, CESA-2022:1935. Same with containers-common. Tenable wants 1.2.4-1.module_el8.6.0 rather than 1-23.module_el8.7.0+1106+45480ee0 even though both have the same 2022-03-16 date in the repo. (CESA-2022:1793, CESA-2022:2143). I don't find any centos-announce email mentioning the above CESA. Are the updates for the modules published separately? Where can I find them? Thank you in advance for your answers, Valère Binet

3 2

Re: [CentOS] Unable to relay mail through gmail anymore
by Richard 05 Aug '22

05 Aug '22

> Date: Friday, August 05, 2022 10:39:04 -0400 > From: Frank Bures <buresf(a)gmail.com> > > I have my CentOS7 sendmail configured to relay outgoing system > e-mail through my gmail account. > > The setup recently stopped working. Gmail SMTP keeps returning > "service unavailable". > > I think it has something to do with the recent changes in Gmail > authentication procedures. > > Does anyone know how to make the relaying work again? I could not > find anything on the Net. I'm assuming you are pushing the mail to gmail through port 465 or 587. If that's the case, if you aren't already, you will need to set up and use a google "app password". Alternatively, get whatever you are using on the centos side that authenticates with gmail to support OAuth 2. You can no longer use your google side-wide password to authenticate 3rd party apps with gmail so need to use one of the alternatives in its place. I would actually expect you to get an authentication failure message so they may have changed something else that disabled this approach.

3 2

Unable to relay mail through gmail anymore
by Frank Bures 05 Aug '22

05 Aug '22

Hi, I have my CentOS7 sendmail configured to relay outgoing system e-mail through my gmail account. The setup recently stopped working. Gmail SMTP keeps returning "service unavailable". I think it has something to do with the recent changes in Gmail authentication procedures. Does anyone know how to make the relaying work again? I could not find anything on the Net. Thanks Frank -- <listfrank1(a)gmail.com>

2 1

oddjob service / selinux denied
by Leon Fauster 05 Aug '22

05 Aug '22

Hey, anyone familiar with the oddjob service? I have configured the dbus and oddjobd and wanted to test it. While calling it with (as root): dbus-send --system --dest=local.domain.oddjob_csc --print-reply /admin local.domain.shee.oddjob_csc.test string:test I get: Error com.redhat.oddjob.Error.Exec: Child signalled exec() error: Permission denied. and type=SYSCALL msg=audit(1659709637.271:196): arch=c000003e syscall=59 success=no exit=-13 a0=55c9f28763d0 a1=55c9f286e0d0 a2=55c9f2870ee0 a3=0 items=0 ppid=4981 pid=6024 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="oddjobd" exe="/usr/sbin/oddjobd" subj=system_u:system_r:oddjob_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1659709637.271:196): avc: denied { transition } for pid=6024 comm="oddjobd" path="/usr/libexec/oddjob/sanity.sh" dev="dm-1" ino=15768 scontext=system_u:system_r:oddjob_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 the configured test script is from the oddjob package: <method name="test"> <helper exec="/usr/libexec/oddjob/sanity.sh" arguments="1"/> <allow user="root"/> </method> As the AVC above shows, its a context transition that is not allowed? How is this service supposed to be used? I suspect that the method call must be in a context by itself, but which one? Any idea? Thanks, Leon

1 0

CentOS-announce Digest, Vol 206, Issue 2
by centos-announce-request＠centos.org 05 Aug '22

05 Aug '22

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2022:5776 Important CentOS 7 firefox Security Update (Johnny Hughes) 2. CESA-2022:5773 Important CentOS 7 thunderbird Security Update (Johnny Hughes) 3. CESA-2022:5905 Important CentOS 7 xorg-x11-server Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 4 Aug 2022 19:06:29 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:5776 Important CentOS 7 firefox Security Update Message-ID: <20220804190629.GA9453(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:5776 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:5776 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 40f292198cfd1d640409908c391eac750a799c0007158bd95505cc00794862e8 firefox-91.12.0-2.el7.centos.i686.rpm e063c651b9c19f3ff44c19dafd53594a57c6c58f609c5e0e419a4b724c4b5f87 firefox-91.12.0-2.el7.centos.x86_64.rpm Source: e41109e1d9cf1ca2b247f423b308abb3eea2f918ad877f071149c35b197277c7 firefox-91.12.0-2.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 4 Aug 2022 19:07:44 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:5773 Important CentOS 7 thunderbird Security Update Message-ID: <20220804190744.GA9863(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:5773 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:5773 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: f009c9c18a2c60a9c998051c6c0a08500ac08b6f4d0b3e130aec02f0bac6afe5 thunderbird-91.12.0-1.el7.centos.x86_64.rpm Source: 9c9112e014a0add7077187c589967a727d13d57ba457721afdf8dd6691040144 thunderbird-91.12.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Thu, 4 Aug 2022 19:09:12 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:5905 Important CentOS 7 xorg-x11-server Security Update Message-ID: <20220804190912.GA10605(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:5905 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:5905 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 9d2caa5bdf17716a2d9e2503e5e5490dd97a317659eb35ed3ee294d10b9132be xorg-x11-server-common-1.20.4-18.el7_9.x86_64.rpm 4ce199f03c4016f4eb22b3d9b8711e1cb1d9864540849b2a5a1c4df4ee5552eb xorg-x11-server-devel-1.20.4-18.el7_9.i686.rpm 1224b4daf58dc2c0d85e8536fe7e439c784d857c15e654ad9c5600780755947e xorg-x11-server-devel-1.20.4-18.el7_9.x86_64.rpm 84f175bef4d2561cae46398abd9317955cdbe6a2c0352227323da35cedc29948 xorg-x11-server-source-1.20.4-18.el7_9.noarch.rpm ef867ce0d361ef3e0350fa0128a70e322998b6b6c0ed8efaf0a06ff011e132c8 xorg-x11-server-Xdmx-1.20.4-18.el7_9.x86_64.rpm db91ac87e5096fe4cf5cd292f4692633d26bdafb9ceefc8288141677f62626ca xorg-x11-server-Xephyr-1.20.4-18.el7_9.x86_64.rpm 98dba21e88ff7d380ddbbdde2d2aa47ccf7bc6da63c4ae460dab25788449a87e xorg-x11-server-Xnest-1.20.4-18.el7_9.x86_64.rpm a88474ca9c7184610d2381b4f56de6ecd823c02da9266a63a5ba57230c0ae64d xorg-x11-server-Xorg-1.20.4-18.el7_9.x86_64.rpm bbe6a456297232dde9056eadfd3e0082764eea1606419c384a0779b6951f9ae7 xorg-x11-server-Xvfb-1.20.4-18.el7_9.x86_64.rpm ead119fe47b9382012e61124387aa69dfe644f344ccdfad3b91a64e1ab35f467 xorg-x11-server-Xwayland-1.20.4-18.el7_9.x86_64.rpm Source: e3a82d200b388e1cd8bb191f92f325b73618b3f19c95a48bed2a71fca3e60065 xorg-x11-server-1.20.4-18.el7_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 206, Issue 2 ***********************************************

1 0

BIND server getting DDOS
by Robert Moskowitz 04 Aug '22

04 Aug '22

I just, maybe, figured out why I have been having problems with my CentOS DNS server with BIND 9.11.4. Aug 2 15:47:19 onlo named[6155]: client @0xaa3cad80 114.29.194.4#11205 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:19 onlo named[6155]: client @0xaa3cad80 114.29.216.196#64956 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:19 onlo named[6155]: client @0xaa3cad80 64.68.114.141#39466 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:19 onlo named[6155]: client @0xaa3cad80 209.197.198.45#13280 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:19 onlo named[6155]: client @0xaa3cad80 114.29.202.117#41955 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:19 onlo named[6155]: client @0xaa3cad80 62.109.204.22#4406 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:49 onlo named[6155]: client @0xa9420720 64.68.104.9#38518 (.): view external: query (cache) './A/IN' denied Aug 2 15:47:50 onlo named[6155]: client @0xaa882dc8 114.29.202.117#9584 (.): view external: query (cache) './A/IN' denied grep -c denied messages 46038 And that is since Jul 31 3am. Anyone have recommendations on how to stop this? thanks

6 7

Missing devel packages?
by Jean-Paul Chaput 27 Jul '22

27 Jul '22

Hello CentOS, After performing an update on July 23, on 9 stream, I did notice problems with egl-wayland. In the AppStream repository, the package: * egl-wayland-1.1.9-2.el9.x86_64.rpm is present, but it's "-devel" counterpart seems missing. So, if you have an older version of egl-wayland-devel installed, it complains that it cannot upgrade "egl-wayland". Same problem seems also to occurs with: * python3-greenlet-1.1.2-3.el9.x86_64.rpm Did I make a mistake or those "-devel" packages are really missing? Best, -- .-. J e a n - P a u l C h a p u t / Administrateur Systeme /v\ Jean-Paul.Chaput(a)lip6.fr /(___)\ work: (33) 01.44.27.53.99 ^^ ^^ cell: 06.66.25.35.55 home: 09.65.29.83.38 S U Sorbonne Université (former UPMC) L I P 6 Laboratoire d'Informatique de Paris VI C I A N Circuits Intégrés Analogiques & Numériques

1 0

bash script input password automatically.
by Kaushal Shriyan 26 Jul '22

26 Jul '22

Hi, I have the below commands to generate keystore.pkcs12 and keystore.jks files on CentOS Linux release 7.9.2009 (Core) openssl pkcs12 -export -clcerts -in fullchain1.pem -inkey privkey1.pem -out keystore.pkcs12 -name javasso keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype pkcs12 -destkeystore keystore.jks -deststoretype jks -alias javasso I have created a small shell script to generate both keystore.pkcs12 and keystore.jks files. It prompts for a password. Is there a way to key in a password without prompt or non-interactive way? For example password is stored in a file and the bash script will source it instead of manually typing the password. Please suggest. Thanks in advance. Best Regards, Kaushal

3 2

selinux / duplicate subject to a custom named one
by Leon Fauster 22 Jul '22

22 Jul '22

Hey everyone, I wonder if I could copy an selinux subject (processes / httpd) to a local named one. So that it gets the same configuration as the source e.g.: httpd_exec_t -> httpd_microservice_exec_t The problem here: Some http microservices written in golang do get the same label as apache httpd (this is intentional for having a confined service): # ls -laZ /usr/libexec/myservice -rwxr-xr-x. 1 root root system_u:object_r:httpd_exec_t:s0 5168952 22. Jul 17:11 /usr/libexec/myservice Unfortunately, these webservices need access to /proc (e.g. for enumerating the sending queue via /proc/sys/net/core/somaxconn). Instead installing a module that allows this for all "httpd_t" allow httpd_t sysctl_net_t:file read; I would like to have a custom configuration thats a duplication of the http_t one. The module would then only allow read access for applications that really need it. Is that possible? Any other straight approach available? -- Thanks Leon

1 0

how to wild-card autofs mount - ?
by lejeczek 15 Jul '22

15 Jul '22

Hi guys. any autofs wizadm reading this and can tell how to "wild-card" this: /home/e23/U: -fstype=nfs4,acl 10.3.3.1:/USER-HOME/e23 I tried $USER in obvious place but it did not mount. many thanks, L.

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss