Discuss

discuss@lists.centos.org

3 participants
34748 discussions

From slashdot, systemd memory corruption bugs
by mark 11 Jan '19

11 Jan '19

Story: Linux systemd Affected by Memory Corruption Vulnerabilities, No Patches Yet (bleepingcomputer.com) 286 Posted by msmash on Thursday January 10, 2019 @01:00PM from the call-the-IT dept. Major Linux distributions are vulnerable to three bugs in systemd, a Linux initialization system and service manager in widespread use, California-based security company Qualys said late yesterday. From a report: The bugs exist in 'journald' service, tasked with collecting and storing log data, and they can be exploited to obtain root privileges on the target machine or to leak information. No patches exist at the moment. Discovered by researchers at Qualys, the flaws are two memory corruption vulnerabilities (stack buffer overflow - CVE-2018-16864, and allocation of memory without limits - CVE-2018-16865) and one out-of-bounds error (CVE-2018-16866). They were able to obtain local root shell on both x86 and x64 machines by exploiting CVE-2018-16865 and CVE-2018-16866. The exploit worked faster on the x86 platform, achieving its purpose in ten minutes; on x64, though, the exploit took 70 minutes to complete. Qualys is planning on publishing the proof-of-concept exploit code in the near future, but they did provide details on how they were able to take advantage of the flaws. -- 30 -- mark "Paging Mr. Poettering...."

1 0

CentOS 7 as a Fibre Channel SAN Target
by Steffan A. Cline 11 Jan '19

11 Jan '19

For quite some time I’ve been using FreeNAS to provide services as a NAS over ethernet and SAN over Fibre Channel to CentOS 7 servers each using their own export, not sharing the same one. It’s time for me to replace my hardware and I have a new R720XD that I’d like to use in the same capacity but configure CentOS 7 as a Fibre Channel target rather than use FreeNAS any further. I’m doing virtualization and this will allow me to have failover from one node to the other since they’ll all be sharing the same export rather than me simply backing up to the FreeNAS server the way I am now. Does anyone know of any really good current articles that explain how to set up CentOS 7 as the target in such a configuration and also setting up CLVMd so they can all share an export over Fibre Channel from CentOS 7? Steffan A. Cline steffan(a)hldns.com 602-793-0014

1 0

IPv6 DUID
by Stephen Berg (Code 7309) 11 Jan '19

11 Jan '19

Does anyone have a utility or method to show the IPv6 DUID for a client system without relying on looking through a DHCP server's logs or waiting until after a request is made? I'd like to determine a client's DUID before I set it up for IPv6, that way I can have it configured in the dhcpd6.conf file for a static assignment before it gets set up. I really don't care if it's an LL, LLT or UUID style as long as I can get it. -- Stephen Berg, IT Specialist, Oceanography Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162

1 0

CentOS-announce Digest, Vol 167, Issue 2
by centos-announce-request＠centos.org 11 Jan '19

11 Jan '19

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2019:0037 CentOS 6 tzdata BugFix Update (Johnny Hughes) 2. CEBA-2019:0037 CentOS 7 tzdata BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 10 Jan 2019 16:16:58 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2019:0037 CentOS 6 tzdata BugFix Update Message-ID: <20190110161658.GA23833(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2019:0037 Upstream details at : https://access.redhat.com/errata/RHBA-2019:0037 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 2c4d3189531d11d7b6c22a1e38eb09b0f7f385ba27654ff013f819323d4227e4 tzdata-2018i-1.el6.noarch.rpm ee295e8462ac2963c1e4a4acbead61abdd80698fafdfdc4c22aed676e5977931 tzdata-java-2018i-1.el6.noarch.rpm x86_64: 2c4d3189531d11d7b6c22a1e38eb09b0f7f385ba27654ff013f819323d4227e4 tzdata-2018i-1.el6.noarch.rpm ee295e8462ac2963c1e4a4acbead61abdd80698fafdfdc4c22aed676e5977931 tzdata-java-2018i-1.el6.noarch.rpm Source: 02fe5160bae134a6673cabb1547ebcc739596bdeed36d043fce3ccde8765e19e tzdata-2018i-1.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 10 Jan 2019 18:13:13 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2019:0037 CentOS 7 tzdata BugFix Update Message-ID: <20190110181313.GA30216(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2019:0037 Upstream details at : https://access.redhat.com/errata/RHBA-2019:0037 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 080cf6683643fb9af8597fcfe91b2aaaef3ad68d110c334c5d56ca5eb711df5e tzdata-2018i-1.el7.noarch.rpm 14f5d2443eb63d74cc7692658aab8eacc0596e71c3792188a21079514c74a202 tzdata-java-2018i-1.el7.noarch.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 167, Issue 2 ***********************************************

1 0

Re: [CentOS] vsftpd rejects users set to nologin
by Stephen John Smoogen 11 Jan '19

11 Jan '19

On Thu, 10 Jan 2019 at 16:09, Kenneth Porter <shiva(a)sewingwitch.com> wrote: > I updated to CentOS 7.6 and something must have changed in the base OS > setup that prevents vsftpd from allowing logins for accounts with > /sbin/nologin as their shell. I had to add that to /etc/shells so that > such > accounts could FTP again. That file is in the setup package. Did it > include > /sbin/nologin before? I don't have anything in my notes from setting up > the > system last year about changing that. What's the history of shells listed > in /etc/shells? > So I think this is a side effect of a long term argument of the security nature of /sbin/nologin https://serverfault.com/questions/328395/nologin-in-etc-shells-is-dangerous… https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… The second thread goes over me being an idiot in multiple places... > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos > -- Stephen J Smoogen.

3 4

vsftpd rejects users set to nologin
by Kenneth Porter 10 Jan '19

10 Jan '19

I updated to CentOS 7.6 and something must have changed in the base OS setup that prevents vsftpd from allowing logins for accounts with /sbin/nologin as their shell. I had to add that to /etc/shells so that such accounts could FTP again. That file is in the setup package. Did it include /sbin/nologin before? I don't have anything in my notes from setting up the system last year about changing that. What's the history of shells listed in /etc/shells?

1 0

Kickstart finishing Installation
by Ralf Prengel 10 Jan '19

10 Jan '19

Hallo, which switch is the right one for Centos 7.6 to finish the installation. Every Installation needs an acknowledgement at the end when the network configuration is shown while installing with grafics. Thanks Ralf Von meinem iPad gesendet

2 2

systemd
by Steve Clark 09 Jan '19

09 Jan '19

Hi List, I am trying to understand what After= means in a unit file. Does it mean after the specified target is up and operational or only that the target has been started? I have something that needs postgres but postgres needs to be operational not just started. Sometimes it can take a bit for postgres to become operational. Thanks, Steve

5 7

high kworker CPU usage in 3.10.0-957 w/ Xorg nouveau driver?
by Sean 09 Jan '19

09 Jan '19

Hi all, I have a number of Gnome/X desktop workstations with NVidia GeForce GT 1030 adapters, dual monitors, Core I7 3770 quad-core hyper-threaded CPUs, with 32GB of RAM. Most (haven't checked them all yet) are exhibiting problems that include significant sluggish-ness with mouse movement and typing as well as screen rendering problems happening since upgrading from kernel 3.10.0-862.14.4.el7.x86_64 to 3.10.0-957.1.3.el7.x86_64. The users have seen this behavior after logging into Gnome, but with out any additional applications running (Chrome/Firefox/LibreOffice, etc.). I can see in top that there are multiple kworker processes consuming a large amount of CPU time and unusually high load averages - like 5-7 range on the 5 minute average, normal load average would be between 1-2 for these users. At one point, while troubleshooting with a user, I was logged in remotely while the user was working on the desktop when it became completely unresponsive. /var/log/messages had nouveau messages like: kernel: nouveau: evo channel stalled kernel: nouveau 0000:01:00.0: disp: chid 1 mthd 0000 data 00000000 10003000 00000000 kernel: nouveau 0000:01:00.0: DRM: base-1: timeout kernel: nouveau 0000:01:00.0: DRM: core notifier timeout Those messages might be meaningless, but they are abundant in the logs. For grins before rebooting, I attempted to stop and start GDM. Both operations seemed successful, I verified all processes owned by the user were gone, and asked him to log in again, but he reported his screens still looked like they did before I restarted GDM and that he didn't have a login screen. Users are currently booting their systems to the 3.10.862 kernel, and this problem does not present itself. I can also add that running the proprietary nvidia driver (from nvidia.com, not elrepo) version 410.78 does not produce this problem. I config manage all these desktops with Puppet and they were all built from by the same kickstart file. The nvidia driver is not purposefully managed by puppet, I just happened to be experimenting with it on my workstation. Before I load the proprietary driver on all the problematic systems, I was hoping someone on the list might have some insight or suggestions. Thanks! --Sean

1 0

NFS deny access
by Thomas Plant 09 Jan '19

09 Jan '19

Hello all, I have an NFS Server where I want give access to a specific address to a specific path. Problem is that I have some other shares active which I do not want the specific IP to not access it. The /etc/exports looks like the following: /nfs/Share1 10.10.*(rw) /nfs/Share2 10.10.*(rw) /kdnbckp/CS21 10.10.193.43(rw) The client on the last line (IP 10.10.193.43) I'd like to exclude from mounting the first two shares. How can I do this? 'man exports' does not give any hint if this is possible. Thanks, Thomas

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss