Discuss

discuss@lists.centos.org

34758 discussions

kickstart post install show in a window
by Jerry Geis 04 Feb '08

04 Feb '08

Is there a way to get all the commands in the post install section from kickstart to show in a window on the X window screenas they are being executed? Jerry

2 1

IPTables GUIs
by Miskell, Craig 04 Feb '08

04 Feb '08

Hi, This is semi-OT, but is Centos-related. I'm looking for an IPTables GUI to help us with our expanding network configuration. I know there's plenty out there, but most of them seem to manage the firewall on the computer on which they run, or only handle one firewall at a time. I need one that can easily manage multiple firewalls from some sort of central location/repository, i.e. sharing definitions of services, hosts etc. I've googled and hunted, and FWBuilder seems reasonably good from what I've seen so far. Are there any other packages out there? Are there any recommendations (to look at or to avoid)? Thanks, Craig Miskell, Technical Support, AgResearch Invermay 03 489-9279 "There are no problems that cannot be solved by the judicious use of high explosives" -- British Commando quote, circa WWII. ======================================================================= Attention: The information contained in this message and/or attachments from AgResearch Limited is intended only for the persons or entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipients is prohibited by AgResearch Limited. If you have received this message in error, please notify the sender immediately. =======================================================================

5 6

Connect to local console from SSH session
by Joseph L. Casale 04 Feb '08

04 Feb '08

I need to see what is happening on the local console to see the status of something I left running, is there a way to do this? Thanks! jlc

5 6

One approach to dealing with SSH brute force attacks.
by James B. Byrne 04 Feb '08

04 Feb '08

Message-ID: <479F2A63.2070408(a)centos.org> On: Tue, 29 Jan 2008 07:30:11 -0600, Johnny Hughes <johnny(a)centos.org> Subject Was: [CentOS] Unknown rootkit causes compromised servers > > SOME of the script kiddies check higher ports for SSH *_BUT_* I only see > 4% of the brute force attempts to login on ports other than 22. > > I would say that dropping brute force login attempts by 96% is quite a > good reason to move the SSH port from 22 to something else. I am not a fan of security through obscurity. If a port is open to the internet then it must be secured whether it is well known or not and if it is properly secured then changing the port number customarily assigned provides no measurable benefit. In my opinion, arbitrarily switching port numbers for well known services provides only the illusion of security while often inconveniencing the legitimate users in unpredictable, and sometimes expensively resolved, fashions. To deal with brute force attacks (not just on ssh) I spent some time tracking down how others had dealt with the problem. I discovered thereby that one can use the simple linux firewall iptables to restrict the number of connections to a given port from a single source over a specified interval. I therefore added these rules to my /etc/sysconfig/iptables file: ... # This is usually present in all setups but, you never know.... # Established connections go right through. -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ... # Block brute force attacks # Drop repeated ssh connection attempts within 20 seconds interval -A RH-Firewall-1-INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 --state NEW -j DROP --rcheck --seconds 20 --name THROTTLE --rsource # Accept ssh connection if not attempted within past 20 sec. -A RH-Firewall-1-INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 --state NEW -j ACCEPT --set --name THROTTLE --rsource You can change the interval from 20 seconds to whatever you feel represents a decent compromise between user satisfaction and security. Many authorities considered a value between 3 and 6 seconds sufficient to render brute force attacks impractical. These rules can be trivially modified to protect any destination port (-dport 21 for ftp for instance) or protocol (-p udp). I hope this information is of use to some of you. I find this list and its archives very helpful myself. Regards, -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

11 12

New hardware to run CentOS
by israel.garcia＠cimex.com.cu 04 Feb '08

04 Feb '08

As I say before, I'm running databases with a lot of users on a CentOS4x server. Somebody ask me to search the latest hardware to migrate my databases to this new server. I have now an HP EVA8000 storage with a lot of hdds, so I want know which is the best hardware to get the best performance with my storage (HP-EVA8000). Any idea will be appreciate. Thanks in advance. Regards, Israel,

2 1

dmcrypt on install with centos 5.1?
by Andrew Henry 04 Feb '08

04 Feb '08

Im new to the list and CentOS and wonder if there is any option to do full disk encryption with dmcrypt and LUKS during the install stage of CentOS 5.1? I use Debian Etch at the moment and Debian is able to to this. If not possible, are there any good guides that anyone knows about that explain how to dmcrypt everything but /boot on CentOS manually? --andrew -- GnuPG Key ID: ECB18ABA Fingerprint: FDF3 91FC F5BC 1164 E217 315E 337E 219B ECB1 8ABA

3 3

RE: Strong security in user's accounts and paswords..[SOLVE]
by israel.garcia＠cimex.com.cu 04 Feb '08

04 Feb '08

Hi Mark and thanks for your soon answer.. I found this excellent guide on internet http://www.puschitz.com/SecuringLinux.shtml... here I could fine all I was looking for about securing my database server running on CentOS.. Regards Israel, >I'm running RHEL 4.6 and am using the features you are looking to >implement. PAM is the direction to look. I have included my >/etc/pam.d/system-auth file as example: >#%PAM-1.0 ># This file is auto-generated. ># User changes will be destroyed the next time authconfig is run. >auth required /lib/security/$ISA/pam_env.so ># The following was added on 12-Apr-06 to count failed password >and "su" attempts >auth required /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root ># End of changes >auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok>> auth required /lib/security/$ISA/pam_deny.so >account required /lib/security/$ISA/pam_unix.so ># The following was added on 12-Apr-06 to count failed password >and "su" attempts >account required /lib/security/$ISA/pam_tally.so per_user >deny=3 no_magic_root reset # End of changes >account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet >account required /lib/security/$ISA/pam_permit.so #password requisite /lib/security/$ISA/pam_cracklib.so retry=3 #password requisite /lib/security/$ISA/pam_cracklib.so retry=3 minlen=10 ucredit=-2 lcredit=-2 dcredit=-2 ocredit=-2 difok=3 # Changed to 15 character length password password requisite /lib/security/$ISA/pam_cracklib.so retry=3 minlen=15 ucredit=-2 lcredit=-2 dcredit=-2 ocredit=-2 difok=3 # Remember the last 15 passwords password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow remember=15 password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so ~ I haven't dealt with this for a while so there my be other changes required. This should be a start for a search with your favorite search engine.

1 0

Re: [CentOS] Re: Monitor power save question
by David G. Miller 04 Feb '08

04 Feb '08

I wrote and now I'm answering my own post: > nate" <centos(a)linuxpowered.net> wrote: >> > David G. Miller wrote: >> > >> > >> >>>> >> > >>>> >> > Section "Device" >>>> >> > Identifier "Videocard0" >>>> >> > Driver "vesa" >>>> >> > EndSection >>>> >>> >> >>> >> > >> > [..] >> > >> > >> >>>> >> > and the video card is (this is a single card that shows up twice in lspci): >>>> >> > >>>> >> > 04:00.0 VGA compatible controller: ATI Technologies Inc RV516 [Radeon >>>> >> > X1300/X1550 Series] (prog-if 00 [VGA]) >>>> >>> >> >>> >> > >> > any particular reason why your using the vesa driver on what seems to >> > be a fairly recent ATI card instead of the ATI specific drivers? Perhaps >> > the vesa driver doesn't work as well with power management(never used it >> > myself for very long). >> > >> > I'd try the ATI drivers and see if it fixes the behavior, you'll probably >> > get much better performance at the same time, with perhaps a bit less >> > stability depending on what you do. >> > >> > nate >> > It's what the install configurator came up with and the ati driver > doesn't work with this video card (output from startx): > > ... > (WW) RADEON: No matching Device section for instance (BusID PCI:4:0:1) found > (WW) R128: No matching Device section for instance (BusID PCI:4:0:1) found > (EE) No devices detected. > > Fatal server error: > no screens found > XIO: fatal IO error 104 (Connection reset by peer) on X server ":0.0" > after 0 requests (0 known processed) with 0 events remaining. > > I like getting a new install stable and fully functional with open > source drivers before introducing perturbations like using a proprietary > display driver. That being said, I just installed the ATI proprietary > driver. So far the system is stable. I'll see whether the monitor > correctly goes to a low power mode tonight. The ATI proprietary driver seems to have fixed the problem. The monitor was in power save mode when I checked it this morning. The ATI Linux Driver wiki at http://wiki.cchtml.com/index.php/Red_Hat_Enterprise_Linux is very badly out of date. It has lots of dire warnings about things not working, work arounds required, etc. I pulled down the driver package from the ATI site, ran it to create a Red Hat rpm and installed the RPM. After I rebooted, everything just worked. I added some comments to the wiki to indicate that the problems described there only apply to RHEL/CentOS 5.0. Upgrading a 5.0 install to 5.1 or installing from 5.1 images and then installing the ATI proprietary driver is a piece of cake. It would be nice if the open source "ati" display driver got extended to include more recent ATI video cards. I'm now running a "tainted" kernel since I have the proprietary fglrx kernel module. Unfortunately, as with how this thread got started, lots of functionality isn't there with the "vesa" display driver. Cheers, Dave -- Politics, n. Strife of interests masquerading as a contest of principles. -- Ambrose Bierce

1 0

Re: [CentOS] One approach to dealing with SSH brute force attacks.
by Les Bell 04 Feb '08

04 Feb '08

mouss <mouss(a)netoyen.net> wrote: >> If you consider this security through obscurity, then why not publish the list of your users on a public web page? after all, you should use strong passwords, so why hide usernames? << Usernames are comparatively hard to guess, and chosen from a large space - although email addresses often provide a huge clue. By contrast, there are only 64K port numbers (and only 1K privileged ports, all of which will be scanned by default with nmap) - and to make it worse, the attacker only has to telnet or nc to a port and sshd will obligingly send back its version number and protocol version info as plaintext. So, the added "obscurity" is effectively zero. I sort of half-buy the log volume/noise argument, but rate-limiting and good analysis tools deal with this as well. And it does nothing for the stress level, since the serious adversary will see through your non-standard port number in seconds. Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

3 2

Strong security in user's accounts and paswords..
by israel.garcia＠cimex.com.cu 04 Feb '08

04 Feb '08

Hi, I have some databases running on CentOS4 with users accessing the shell (bash), so I'd like to strong the security on my server in user's accounts and passwords.. I mean, enforcing strong passwords, min/max age passwords, locking passwords when you fail 3 times, and all this stuff. Is there any package which do this work? Any tutorial? Thanks in advance Regards Israel

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss