Discuss

discuss@lists.centos.org

5 participants
34752 discussions

Re: [CentOS] NBDE, clevis and tang for non-root disk
by mark 27 Nov '18

27 Nov '18

Radu Radutiu wrote: > On Tue, Nov 27, 2018 at 3:14 PM mark <m.roth(a)5-cent.us> wrote: > >> What we do is to have the encryption key of the secondary filesystem in >> /etc/crypttab, which is, of course, 600. As it boots, it decrypts from >> that as it mounts the rest of the system. >> > Thanks, this is working as expected and it gave me the hint needed to > find the actual problem. The problem is that the initramfs image generated > by dracut -f does not include the /etc/crypttab from the OS (it only > contains the entry for the root device). Once I have manually added the > other volumes in the /etc/crypttab file from the initramfs image, clevis > is able to decrypt all volumes. Now the question is why the generated > iniramfs image has a different /etc/crypttab. How can I specify > /etc/crypttab for the initramfs so that > furhter kernel updates will not replace it with the wrong file? > Sorry, I think you misunderstood. The key for root is *not* in /etc/crypttab - that's only for the secondary ones. mark

2 1

C7 install, "failed to IDENTIFY"
by mark 27 Nov '18

27 Nov '18

The install from a USB key fails. It's showing ata2:0.0 failed to IDENTIFY. I've been searching online, and the only hint I have is that it might not understand the controller. New Dell Optiplex 7050. Haanyone run into this? mark

2 1

Re: [CentOS] NBDE, clevis and tang for non-root disk
by Radu Radutiu 27 Nov '18

27 Nov '18

On Tue, Nov 27, 2018 at 3:14 PM mark <m.roth(a)5-cent.us> wrote: > What we do is to have the encryption key of the secondary filesystem in > /etc/crypttab, which is, of course, 600. As it boots, it decrypts from > that as > it mounts the rest of the system. > > mark > Thanks, this is working as expected and it gave me the hint needed to find the actual problem. The problem is that the initramfs image generated by dracut -f does not include the /etc/crypttab from the OS (it only contains the entry for the root device). Once I have manually added the other volumes in the /etc/crypttab file from the initramfs image, clevis is able to decrypt all volumes. Now the question is why the generated iniramfs image has a different /etc/crypttab. How can I specify /etc/crypttab for the initramfs so that furhter kernel updates will not replace it with the wrong file? Radu

1 0

CentOS 7 bash perhaps off topic
by Jerry Geis 26 Nov '18

26 Nov '18

hi all, I have a small script that seems to be exiting and hitting the sleep 60... The smwebsocket just connects to the web socket provided and outputs the data. This works manually. the myprogram just opens a database and writes the line... My desire is to run the smwebsocket, connect to the websocket and output the data (line by line) when we get a line that matches Location take that line and output to the database. Seems simple. I desire this to keep the connection alive and just continue to read data and grep on the data etc... if smwebsocket does exit, sleep 60 and reconnect. However it seems to be exiting and running the sleep 60. Am I missing something ? while [ 1 ] do smwebsocket "$URL" | grep Location | while read line do myprogram -data "$line" done sleep 60 Reconnecting... done All the pieces work - just not the actual running. What am I missing? Jerry

3 3

kernel 3.10.0-957.el7.x86_64 + EFI on Dell server - problem
by lejeczek 26 Nov '18

26 Nov '18

hi guys I've one box where I just yesterday upgraded Centos. I wonder if that kernel upgrade process might somewhat troublesome. After that upgrade UEFI boot fails with: Failed to set MokListRT: Invalid Parameter Something has gone seriously wrong: import_mok_state() failed : Invalid Parameter Has anybody seen that? And maybe know to fix it? many thanks, L.

6 9

rpmbuild errors
by Alessandro Baggi 26 Nov '18

26 Nov '18

Hi list, I need a more updated version of bacula because I need to backup a debian workstation. So I decided to build my own bacula package base on bacula 9.2.0. I'm new to rpmbuild and I created my bacula.spec file but when running rpmbuild -ba bacula.spec I got error about check-rpaths like: ERROR 0001: file '/usr/sbin/bregex' contains a standard rpath '/usr/lib64' in [/usr/lib64] Running rpmbuild as suggested, adding QA_RPATHS=$[ 0x0001|0x0010 ] works without problem but I don't understand what is wrong with my spec files. Another issue that I found is when installing this rpm. It reports that my bacula package requires libbaccats-9.2.0.so()(64bit) but this file is inside rpm so to solve this I must add to my spec file: Provides: libbaccats-9.2.0.so()(64bit) That permit to install my new rpm. How I can solve this 2 issues? Thanks in advance.

1 0

NBDE, clevis and tang for non-root disk
by Radu Radutiu 26 Nov '18

26 Nov '18

Hi, Has anybody managed to get network disk bound disk encryption to work with a non-root disk? It works fine for the root device, but the moment I add another volume to /etc/crypttab the system will no longer boot automatically. A tcpdump on the tang server shows no traffic while the system is stuck at the LUKS password prompt. The second encrypted volume is set up in the same way as the root device and I can unlock the volume using clevis-luks-unlock -d /dev/vda3. I've seen in https://rhelblog.redhat.com/2018/04/13/an-easier-way-to-manage-disk-decrypt… that clevis-luks-askpass.path needs to be enabled but it doesn't make a difference. Any ideas on what 's wrong or how to debug this? Best regards, Radu

1 0

digital signature equipment
by Gregory P. Ennis 26 Nov '18

26 Nov '18

Everyone, I apologize if this is off topic for this list!!!!! I have an application that I need to acquire, store and merge to a pdf file a digital signature from a client. What favorite equipment do some of you use to do this. I contacted the topaz systems support team, and they advised me their equipment produced a proprietary file type, and required me to sign a non-disclosure agreement to do what I was asking to do. I indicated I was willing to proceed, but I have not been able to get them to communicate in follow up. .... probably related to the holidays. I will be using Centos 7.5 Desktop units to acquire the images and send the images to a Centos 7.5 server that will do the storage, and merging work. I have been able to use pdftk to merge previously obtained signatures, but I have not been able to find a piece of equipment that I can use to acquire signatures on the fly and merge them easily to a pdf form file. Any suggestions would be appreciated!!!! Greg Ennis

2 6

Panic / EL6 / KVM / kernel-2.6.32-754.2.1.el6.x86_64
by Leon Fauster 23 Nov '18

23 Nov '18

Since the update from kernel-2.6.32-754.2.1.el6.x86_64 to kernel-2.6.32-754.3.5.el6.x86_64 I can not boot my KVM guests anymore!? The workstation panics immediately! I would not have expected this behavior now (last phase of OS). It was very robust until now (Optiplex Workstation). I see some KVM related lines in the changelog.diff. Before swimming upstream: Does some one have problems related to KVM with kernel-2.6.32-754.3.5.el6.x86_64 ?? -- LF

5 15

Video from the CentOS Dojo at CERN now available
by Rich Bowen 23 Nov '18

23 Nov '18

The videos from the recent #CentOSDojo at #CERN are now available on the CentOS YouTube channel. If you have time for only one, be sure to watch the first video, which talks about the challenges that CERN has with the enormous amount of data they produce every day in the LHC. Also recommended, Fabian's discussion of the coming (and already in place!) changes to the CentOS Git infrastructure. https://www.youtube.com/watch?v=fs8knVCqEj4&list=PLuRtbOXpVDjBVqThWSByt… -- Rich Bowen - rbowen(a)redhat.com @CentOSProject // @rbowen 859 351 9166

6 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss