Discuss

discuss@lists.centos.org

34753 discussions

Re: [CentOS] General questions about security
by Les Bell 01 Feb '08

01 Feb '08

Niki Kovacs <contact(a)kikinovak.net> wrote: >> Thanks for your very detailed response. << Trust me when I say: that wasn't detailed. Nowhere near it. >> - Is it worth the hassle to bother with SELinux? - Is the standard firewall configuration enough << You can go light on all that policy stuff, especially in a small business environment, but you need to give it at least superficial consideration. Until you do, you can't answer those questions, and we certainly can't. Would, say, a web site defacement cause your organization significant embarrassment? Would it cost you your job? Could borrowers' personal information be compromised? Are you storing information like SSN's? At what point does the benefit exceed the costs? The hassle is worth it for defense/government applications involving classified data, obviously. Probably not worth it for a web-surfing home desktop. You're somewhere - where? - in between. Only you can know, and it depends on business considerations. Remember: "Ready! Fire! Aim!". One easy out: the "due diligence" approach. Find out what other libraries are doing, and do the same or better. The Koha, OpenBiblio and other mailing lists could be a help here. I'll let others clue you in on various web vulnerabilities - SQL injection, command injection, cross-site scripting, overflows, etc. - as well as tools like Nessus, Nikto, etc. for vuln scanning. However, your top priority here should be proactive patch management and intrusion detection techniques such as log file monitoring/analysis. Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

1 0

General questions about security
by Niki Kovacs 01 Feb '08

01 Feb '08

Hi, I admit I never gave security that much thought, that is, except the most basic security rules like choosing good passwords, or reasonable file and directory permissions. But now I have to change that, since I'll soon have to setup a dedicated production server for our public libraries. I wonder where to begin. I would say first thing is get a series of "auditing" tools such as, for example, the port scanner nmap, to test the firewall on the server. Any other ideas for that? The firewall: CentOS includes a default firewall, where ports can be chosen using a simple graphical (or ncurses) tool. Is that solid enough for a web server? Or do you recommend diving into the innards of iptables? Or maybe, other solution, can you recommend some good "reasonable" set of rules for a web server, for example? Last but not least: SELinux. For the moment I don't use it. I read the chapter on SELinux in "Red Hat Enterprise Linux 5 Unleashed" by Tammy Fox, and I simply wonder if it's worth the pain. I'm curious about your opinions about this subject. Maybe some good reads on security? That is, articles that don't require you to be a doctor in computer science to get a grasp of the subject? And also documentation that doesn't require me to have a life expectance of 500+ years :oD Any suggestions? Niki

2 1

loopback network device
by Jordi Prats 01 Feb '08

01 Feb '08

Hi all, It's possible to create an alias of a device? Something like a device loN that all it's traffic is send to ethN, so ethN and loN are equivalent. It's for a bridged setup, i'm not trying to setup another IP on a device. Thanks! Jordi -- ...................................................................... __ / / Jordi Prats C E / S / C A Dept. de Sistemes /_/ Centre de Supercomputació de Catalunya Gran Capità, 2-4 (Edifici Nexus) · 08034 Barcelona T. 93 205 6464 · F. 93 205 6979 · jprats(a)cesca.es ......................................................................

2 1

rsync and swapping
by Jerry Geis 01 Feb '08

01 Feb '08

hi all, I use rsync to copy/backup ALL my stuff to another disk. When I run this seems like my machine (4 GIG ram centos 5.1) now begins to swap out more programs. Is there a way to reduce that swapping? I am running with echo 1 > /proc/sys/vm/swappiness I simply mount /dev/sdc1 /mnt/backup; mkdir /mnt/backup/month.day.year then rsync -a /home /mnt/backup/mon.day.year This is approximately 102G of data. Thanks for any suggestions. Jerry

14 20

Problems to install java plugin in CentOS 5.1 x86_64
by Sergio Belkin 01 Feb '08

01 Feb '08

Hi! I've tried to install java plugin as is in http://www.howtoforge.com/installation-guide-centos5.1-desktop-p7 but with no success. All steps seems to go well, with no error messages, but Firefox says that there is no java plugin. Please, tell me what could be wrong? Thanks in advance!! -- Sergio Belkin ----------------------------------------

3 5

centosplus + priority plugin
by Christopher Chan 31 Jan '08

31 Jan '08

I have a Centos 4 box that has been updated all the way to 4.6 without using the centosplus repository. Now I want to use the centosplus repository for Centos 4 to get the latest LAMP, mod_perl, perl and other perl modules so that I can install rt 3.6.6 and its necessary modules. However, for some reason, the latest perl package in the centosplus repository does not appear on the radar when I run yum check-update. Has anybody ran into this and get around the problem? Contents of yum.conf and Centos-Base.repo and output from yum check-update follow. Christopher cat /etc/yum.conf [main] cachedir=/var/cache/yum debuglevel=2 logfile=/var/log/yum.log pkgpolicy=newest distroverpkg=centos-release tolerant=1 exactarch=1 retries=20 obsoletes=1 gpgcheck=1 plugins=1 exclude=postfix* cyrus-sasl* dovecot* -------------------------------------------------------------------- cat /etc/yum.repos.d/CentOS-Base.repo # CentOS-Base.repo # # This file uses a new mirrorlist system developed by Lance Davis for CentOS. # The mirror system uses the connecting IP address of the client and the # update status of each mirror to pick mirrors that are updated to and # geographically close to the client. You should use this for CentOS updates # unless you are manually picking other mirrors. # # If the mirrorlist= does not work for you, as a fall back you can try the # remarked out baseurl= line instead. # # [base] name=CentOS-$releasever - Base #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os baseurl=http://ftp.hostrino.com/pub/centos/$releasever/os/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 exclude=php* httpd* postgres* MySQL* mysql* perl perl-DBD-MySQL perl-DBD-Pg perl-DBI perl-suidperl unixODBC* mod_auth_mysql mod_auth_pgsql mod_perl mod_perl-devel mod_ssl priority=1 #released updates [update] name=CentOS-$releasever - Updates #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates baseurl=http://ftp.hostrino.com/pub/centos/$releasever/updates/$basearch/ gpgcheck=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 exclude=php* httpd* postgres* MySQL* mysql* perl perl-DBD-MySQL perl-DBD-Pg perl-DBI perl-suidperl unixODBC* mod_auth_mysql mod_auth_pgsql mod_perl mod_perl-devel mod_ssl priority=1 #packages used/produced in the build but not released [addons] name=CentOS-$releasever - Addons #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=addons baseurl=http://ftp.hostrino.com/pub/centos/$releasever/addons/$basearch/ gpgcheck=1 enabled=0 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 #additional packages that may be useful [extras] name=CentOS-$releasever - Extras #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=extras baseurl=http://ftp.hostrino.com/pub/centos/$releasever/extras/$basearch/ gpgcheck=1 enabled=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 #additional packages that extend functionality of existing packages [centosplus] name=CentOS-$releasever - Plus #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=centosplus baseurl=http://ftp.hostrino.com/pub/centos/$releasever/centosplus/$basearch/ gpgcheck=1 enabled=1 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 priority=2 #contrib - packages by Centos Users [contrib] name=CentOS-$releasever - Contrib #mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=contrib baseurl=http://ftp.hostrino.com/pub/centos/$releasever/contrib/$basearch/ gpgcheck=1 enabled=0 gpgkey=http://mirror.centos.org/centos/RPM-GPG-KEY-centos4 ---------------------------------------------------------------- yum check-update Loading "priorities" plugin Setting up repositories Reading repository metadata in from local files Excluding Packages in global exclude list Finished Excluding Packages from CentOS-4 - Updates Finished Excluding Packages from CentOS-4 - Base Finished 43 packages excluded due to repository priority protections httpd.x86_64 2.0.59-1.el4s1.10.el4. centosplus httpd-manual.x86_64 2.0.59-1.el4s1.10.el4. centosplus mod_perl.x86_64 2.0.3-1.el4s1.3 centosplus mod_ssl.x86_64 1:2.0.59-1.el4s1.10.el centosplus mysql.x86_64 5.0.54-1.el4.centos centosplus mysql-devel.x86_64 5.0.54-1.el4.centos centosplus mysql-server.x86_64 5.0.54-1.el4.centos centosplus mysqlclient10.x86_64 3.23.58-9.2.c4 centosplus perl-DBD-MySQL.x86_64 3.0008-1.el4.centos centosplus perl-DBD-Pg.x86_64 1.49-1.el4s1 centosplus perl-DBI.x86_64 1.54-1.el4s1 centosplus php.x86_64 5.1.6-3.el4s1.8 centosplus php-gd.x86_64 5.1.6-3.el4s1.8 centosplus php-ldap.x86_64 5.1.6-3.el4s1.8 centosplus php-mbstring.x86_64 5.1.6-3.el4s1.8 centosplus php-pear.noarch 1:1.4.11-1.el4s1.1 centosplus php-pgsql.x86_64 5.1.6-3.el4s1.8 centosplus postgresql.x86_64 8.1.9-1.el4s1.1 centosplus postgresql-devel.x86_64 8.1.9-1.el4s1.1 centosplus postgresql-libs.x86_64 8.1.9-1.el4s1.1 centosplus postgresql-server.x86_64 8.1.9-1.el4s1.1 centosplus unixODBC.x86_64 2.2.12-1.el4s1.1 centosplus

2 3

VMWare 6.02 and Linux screen saver?
by Scott Ehrlich 31 Jan '08

31 Jan '08

I have a user who freshly installed CentOS on their desktop. They also installed VMWare 6.02. When they click the mouse on their Linux desktop, the screen saver properly activates. But, when they click the mouse in their VMWare session, the Linux screen saver never activates. This has been tried for both VMWare Player and Workstation. I don't know if it makes any difference, but the VMWare Guest OS is Windows XP w/SP2. Thanks for any insight. Scott

2 1

adaptec 2100S drivers
by Mark Weaver 31 Jan '08

31 Jan '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I've got a server that I'm rebuilding and I've been given an Adaptec 2100S single channel scsi card to use. Problem is I can't find drivers for CentOS 4 anywhere. So far I've tried the adaptec drivers on the install CD but when it comes time to use disc druid it doesn't see the array that I've setup. don't know if it matters, but I've got the CDROM on IDE0 port and nothing on IDE1 port. Are there drivers for this scsi card anywhere? thanks, - -- Mark "If you have found a very wise man, then you've found a man that at one time was an idiot and lived long enough to learn from his own stupidity." ============================================== Powered by CentOS5 (RHEL5) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: GnuPT 2.5.8.1 by EQUIPMENTE.DE iD8DBQFHoNHkXIpLU+e4OpgRAgltAKCVRlOlrtXSHz4ptqeEVV58rGsEDACgkwzN f1RNeKUBfq8AaISTe5KFIPM= =+MVB -----END PGP SIGNATURE-----

2 1

About Creating a DVD iso from Cd's isos
by Manuel Enrique Chavez Manzano 31 Jan '08

31 Jan '08

I had tried the bash script that there is on the wiki about How to create a DVD from Cd's I got no errors during the making of the DVD but the size of the final DVD.iso is about 2.2 Gb when I look into the mirrors page a DVD iso is about 4 gb Is theiso size correct?, or I'm doing something wrong???

1 0

Where is gpg-agent?
by Anne Wilson 31 Jan '08

31 Jan '08

The only obstacle now to running this box as the mail server is that I do read and send mail on it occasionally, while working on something. I need gpg-agent, but can't find how to get it. Is it merged into another package, or do I simply have to look at other repositories? Anne

3 7

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss