Discuss

discuss@lists.centos.org

34729 discussions

Introducing CentOS Stream 9
by Johnny Hughes 05 Apr '22

05 Apr '22

Rich Bowen has posted a blog entry "Introducing CentOS Stream 9" https://blog.centos.org/2021/12/introducing-centos-stream-9/ More details here: https://centos.org/stream9/ Thanks, Johnny Hughes

5 13

Two labels, one mount point
by Kenneth Porter 01 Apr '22

01 Apr '22

I have a systemd mount unit that mounts an external drive by label. What happens if I plug in two USB external drives formatted with the same label? Does the last one discovered mount on top? I'm rotating backup drives and the backup software assumes the drive to be at a particular directory. Normally I'd stop the service, umount the drive (via systemd stop), unplug, plug the other one in, then start the service. (An automount unit will mount the replacement drive when the service touches the mount point.) But I'm wondering what happens if someone isn't careful and plugs in the 2nd drive before shutting down the service and removing the first one.

1 0

SELinux relabeling for a diffeerernt mount point
by Kenneth Porter 01 Apr '22

01 Apr '22

I'm preparing a disk mounted at /mnt/tmp to later be mounted at /var/lib/BackupPC. Is there some magic invocation to get the selinux labels for the structure I create to assume the final mount point, so that I don't have to relabel it when it's finally mounted at its target location? Or is there an argument to restorecon that will do the equivalent of chroot so that restorecon assumes the final location?

2 1

CentOS-announce Digest, Vol 203, Issue 2
by centos-announce-request＠centos.org 30 Mar '22

30 Mar '22

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2022:1032 CentOS 7 tzdata BugFix Update (Johnny Hughes) 2. CESA-2022:1045 Important CentOS 7 httpd Security Update (Johnny Hughes) 3. CESA-2022:1066 Important CentOS 7 openssl Security Update (Johnny Hughes) 4. CESA-2022:0824 Critical CentOS 7 firefox Security Update (Johnny Hughes) 5. CESA-2022:0850 Important CentOS 7 thunderbird Security Update (Johnny Hughes) 6. CESA-2022:1069 Important CentOS 7 expat Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 Mar 2022 13:34:23 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2022:1032 CentOS 7 tzdata BugFix Update Message-ID: <20220329133423.GA21687(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2022:1032 Upstream details at : https://access.redhat.com/errata/RHBA-2022:1032 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: ef535692955e3b9dc14a633b487f86ba36720866a39c354e86275b7f23d6adba tzdata-2022a-1.el7.noarch.rpm 69bfe28a120aa3364ed2beefdae50126ff4e6b20ea1caf0f1054904964676724 tzdata-java-2022a-1.el7.noarch.rpm Source: 3f0438cb6e72b6f0d7005a2e2783c608cc8603a480718b38697ffdc675096223 tzdata-2022a-1.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 29 Mar 2022 13:35:36 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:1045 Important CentOS 7 httpd Security Update Message-ID: <20220329133536.GA22208(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:1045 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:1045 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 35fc790f76f1d12e738a6b5cd1438085704844f9c267638a15f9cc080376b10d httpd-2.4.6-97.el7.centos.5.x86_64.rpm 57e3a74cb68c72426ee6a022b286950bbc4ac0c0a450be5d5e07d0a0ac91fcc0 httpd-devel-2.4.6-97.el7.centos.5.x86_64.rpm a52b0985bc9791dee53f7a73f22051cc229824892249b53b748eaad81619a0bf httpd-manual-2.4.6-97.el7.centos.5.noarch.rpm 601f376aa7ef59f60e13ba11f0a9a7286b883a945173b5b829fe2e939b6b3d1e httpd-tools-2.4.6-97.el7.centos.5.x86_64.rpm 9bc8c09cfaaabcb254797b1579fccbbf5a7ac3febd8172c07ad6764c33c3270e mod_ldap-2.4.6-97.el7.centos.5.x86_64.rpm d69a242a1a58b858cffa727cb8193e2ccaf358421e81076cf5c96b4a5082d5f9 mod_proxy_html-2.4.6-97.el7.centos.5.x86_64.rpm 1cd1ae8c0b9506f0a8066d9b0a935712889175386de9909062d20b0523e2876b mod_session-2.4.6-97.el7.centos.5.x86_64.rpm e1558062e338ec19488115a645f60559e370f1ddbf06a4b6e522b9803ac21304 mod_ssl-2.4.6-97.el7.centos.5.x86_64.rpm Source: e7711bdac101195a87b7ceb1d05293aee71c10fdc9b7f662e593211c94448035 httpd-2.4.6-97.el7.centos.5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Tue, 29 Mar 2022 13:36:31 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:1066 Important CentOS 7 openssl Security Update Message-ID: <20220329133631.GA22661(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:1066 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:1066 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 03b9fa607eacb360a4f21fe9861d8a7d571cf120e781d9e0c5639af4c8923a17 openssl-1.0.2k-25.el7_9.src.rpm 04f581972286e776f852cf380fd0a4c05af1556c3d62f8ad579d87985ee0467c openssl-1.0.2k-25.el7_9.x86_64.rpm 08396cb866f024b0054c16918fe544406f737f7ddefcecbda04ad29ab9a27a15 openssl-devel-1.0.2k-25.el7_9.i686.rpm 5989f8701c6fe912d154675a3f7ad276f5dccc5afc8ccce28405408ee673c16c openssl-devel-1.0.2k-25.el7_9.x86_64.rpm 7a1256ee4fd271d588649f70d8aa4492d3967b0afd9d82a145275924442baae0 openssl-libs-1.0.2k-25.el7_9.i686.rpm c01bfc1d06b6e8d39a0bb038993a565a42a4f152542fec05d266098c4206140f openssl-libs-1.0.2k-25.el7_9.x86_64.rpm 593df90370183706f3bc69451b1aa4c6cd88b0a4d1d3964bc1b8e621b3d67d97 openssl-perl-1.0.2k-25.el7_9.x86_64.rpm d2bc75a69afc2e940e2a933c55941d7c4f269ade992c161c681b9cd72ff158a4 openssl-static-1.0.2k-25.el7_9.i686.rpm 1adcef07e0e83f4fc27809eacf51bdd1d75267095f0cf92832e1d636e04e477c openssl-static-1.0.2k-25.el7_9.x86_64.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Tue, 29 Mar 2022 13:53:09 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:0824 Critical CentOS 7 firefox Security Update Message-ID: <20220329135309.GA2963(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:0824 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2022:0824 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 078df219eb34b52cef5f93c17533da34f2eceaec30e85da8944716d38dfee196 firefox-91.7.0-3.el7.centos.i686.rpm 0b48a1dc6bd965ac5f800c44cf498da51c5fd0ec07bf16a07911d66f89932c4b firefox-91.7.0-3.el7.centos.x86_64.rpm Source: fe895a292e341716911619c187d5030176eda5d1c55869a61faf1cde01e442f1 firefox-91.7.0-3.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 5 Date: Tue, 29 Mar 2022 13:54:14 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:0850 Important CentOS 7 thunderbird Security Update Message-ID: <20220329135414.GA3371(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:0850 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:0850 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: d75ace9160c666f8c11b19909fd788117c9134c9ec1c12c636f6a45ee642ed18 thunderbird-91.7.0-2.el7.centos.x86_64.rpm Source: f12b857c03422ca4fd610898acf959c554126e0038b0cff81d2fd9466b1532bd thunderbird-91.7.0-2.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Message: 6 Date: Tue, 29 Mar 2022 22:31:03 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2022:1069 Important CentOS 7 expat Security Update Message-ID: <20220329223103.GA21014(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2022:1069 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:1069 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: c653aaa3759f6c65e6ccf1dafa36096bf4821f315dbf756943730947258100ef expat-2.1.0-14.el7_9.i686.rpm b0179562abc1ff5d40c03661749ce4f7f4c7d58c428cecfc4a3711bfa98e6ec6 expat-2.1.0-14.el7_9.x86_64.rpm f4c0956c54c55adea5769904bb460f6ab64b017d31e9a73f0a047345be6dd6af expat-devel-2.1.0-14.el7_9.i686.rpm 301d479dffc9084746269cad6d9be379a3c01fafa139c9203aa5c98ca7e9d79e expat-devel-2.1.0-14.el7_9.x86_64.rpm a962654ff0fe134fdd88392c47a711e94bc84e08e27d0a7cb7d28e9150d2999a expat-static-2.1.0-14.el7_9.i686.rpm 46c46ba8573d8f101c53fe10179a66e853ec151d66f5dfb686fb60c5e75aa610 expat-static-2.1.0-14.el7_9.x86_64.rpm Source: 6c86a22138aaddd33328f353b445995e9a67f824e4cb25423b1e07b325142366 expat-2.1.0-14.el7_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)libera.chat Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 203, Issue 2 ***********************************************

1 0

Updating a package to one from a different repository
by Kenneth Porter 29 Mar '22

29 Mar '22

At some point I updated fail2ban from a copr repo to get the latest release. That repo no longer exists but a newer version is available in EPEL. Is there a direct way to get yum to update using the different repo? Or do I need to save my config and DB, erase the old version, and install the new one from EPEL?

2 1

Compatible SATA controller needed
by Pete Geenhuizen 27 Mar '22

27 Mar '22

I'm trying to install Centos 8 on an older PC but it fails because the SATA controller isn't supported. Anyone have a source for a PCI/ePCI controller card that is compatible with Centos 8? Thanks Pete -- Unencumbered by the thought process. -- Click and Clack the Tappet brothers

4 5

kernel message format - how ?
by lejeczek 24 Mar '22

24 Mar '22

Hi guys. When kernel - I think - broadcasts messages, spits to console, I wonder how one controls that message format. I specifically think of what 'dmesg' offers for time parts of the message, eg. '--reltime' - so the same only persistent/default behavior. many thanks, L.

1 0

Cron and GNU parallel
by Joseph L. Casale 21 Mar '22

21 Mar '22

I am using parallel-20190922-1 from epel and when I run a job in cron such as /usr/bin/parallel /usr/bin/bash ::: a.sh b.sh c.sh I don't receive any mail regardless of all three scripts generating output. All other jobs in cron generate mail if they write to stdout or stderr. When the above is run at a terminal, I get the output from all three jobs grouped in the order they complete. I can't find any documentation for parallel that states the behavior when not running with a terminal. Anyone have any ideas? Thanks, jlc

1 0

Re: [CentOS] Updating a package to one from a different repository
by Fred 21 Mar '22

21 Mar '22

Delete the package then reinstall from EPEL??? On Mon, Mar 21, 2022, 10:33 Kenneth Porter <shiva(a)sewingwitch.com> wrote: > At some point I updated fail2ban from a copr repo to get the latest > release. That repo no longer exists but a newer version is available in > EPEL. Is there a direct way to get yum to update using the different repo? > Or do I need to save my config and DB, erase the old version, and install > the new one from EPEL? > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos >

1 0

TCP Sequence Number Approximation Based Denial of Service on CentOS Linux release 7.9.2009 (Core)
by Kaushal Shriyan 18 Mar '22

18 Mar '22

Hi, I have 3.10.0-1160.59.1.el7.x86_64 on CentOS Linux release 7.9.2009 (Core) running Nagios Monitoring system. We have run an external vulnerability scan today on this server. The vulnerability reports say the below details. I am not sure if I completely understand the below issue. CVSS base score:- 5.0 CVE-2004-0230 Severity : Medium TCP Sequence Number Approximation Based Denial of Service TCP provides stateful communications between hosts on a network. TCP sessions are established by a three-way handshake and use random 32-bit sequence and acknowledgement numbers to ensure the validity of traffic. A vulnerability was reported that may permit TCP sequence numbers to be more easily approximated by remote attackers. This issue affects products released by multiple vendors. The cause of the vulnerability is that affected implementations will accept TCP sequence numbers within a certain range, known as the acknowledgement range, of the expected sequence number for a packet in the session. This is determined by the TCP window size, which is negotiated during the three-way handshake for the session. Larger TCP window sizes may be set to allow for more throughput, but the larger the TCP window size, the more probable it is to guess a TCP sequence number that falls within an acceptable range. It was initially thought that guessing an acceptable sequence number was relatively difficult for most implementations given random distribution, making this type of attack impractical. However, some implementations may make it easier to successfully approximate an acceptable TCP sequence number, making these attacks possible with a number of protocols and implementations. This is further compounded by the fact that some implementations may support the use of the TCP Window Scale Option, as described in RFC 1323, to extend the TCP window size to a maximum value of 1 billion. This vulnerability will permit a remote attacker to inject a SYN or RST packet into the session, causing it to be reset and effectively allowing for denial of service attacks. An attacker would exploit this issue by sending a packet to a receiving implementation with an approximated sequence number and a forged source IP address and TCP port. There are a few factors that may present viable target implementations, such as those which depend on long-lived TCP connections, those that have known or easily guessed IP address endpoints and those implementations with easily guessed TCP source ports. It has been noted that Border Gateway Protocol (BGP) is reported to be particularly vulnerable to this type of attack, due to the use of long-lived TCP sessions and the possibility that some implementations may use the TCP Window Scale Option. As a result, this issue is likely to affect a number of routing platforms. Another factor to consider is the relative difficulty of injecting packets into TCP sessions, as a number of receiving implementations will reassemble packets in order, dropping any duplicates. This may make some implementations more resistant to attacks than others. It should be noted that while a number of vendors have confirmed this issue in various products, investigations are ongoing and it is likely that many other vendors and products will turn out to be vulnerable as the issue is investigated further. Solution Please first check the results section below for the port number on which this vulnerability was detected. If that port number is known to be used for port-forwarding, then it is the backend host that is really vulnerable. Various implementations and products including Check Point, Cisco, Cray Inc, Hitachi, Internet Initiative Japan, Inc (IIJ), Juniper Networks, NEC, Polycom, and Yamaha are currently undergoing review. Contact the vendors to obtain more information about affected products and fixes. " http://packetstormsecurity.org/0404-advisories/246929.html" NISCC Advisory 236929 - Vulnerability Issues in TCP details the vendor patch status as of the time of the advisory, and identifies resolutions and workarounds. Refer to "http://www.kb.cert.org/vuls/id/415294" US-CERT Vulnerability Note VU#415294 and "http://osvdb.org/4030" OSVDB Article 4030 to obtain a list of vendors affected by this issue and a note on resolutions (if any) provided by the vendor. For Microsoft: Refer to " https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms…" MS05-019 and " https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms…" MS06-064 for further details. For SGI IRIX: Refer to " ftp://patches.sgi.com/support/free/security/advisories/20040905-01-P.asc" SGI Security Advisory 20040905-01-P For SCO UnixWare 7.1.3 and 7.1.1: Refer to " ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt" SCO Security Advisory SCOSA-2005.14 For Solaris (Sun Microsystems): The vendor has acknowledged the vulnerability; however a patch is not available. Refer to "http://www.kb.cert.org/vuls/id/JARL-5YGQAJ" Sun Microsystems, Inc. Information for VU#415294 to obtain additional details. Also, refer to "http://www.us-cert.gov/cas/techalerts/TA04-111A.html" TA04-111A for detailed mitigating strategies against these attacks. For NetBSD: Refer to " ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.a…" NetBSD-SA2004-006 For Cisco: Refer to " http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml" cisco-sa-20040420-tcp-ios.shtml . For Red Hat Linux: There is no fix available. Workaround: The following BGP-specific workaround information has been provided. For BGP implementations that support it, the TCP MD5 Signature Option should be enabled. Passwords that the MD5 checksum is applied to should be set to strong values and changed on a regular basis. Secure BGP configuration instructions have been provided for Cisco and Juniper at these locations: " http://www.cymru.com/Documents/secure-bgp-template.html" Secure Cisco IOS BGP Template " http://www.cymru.com/gillsr/documents/junos-bgp-template.pdf" JUNOS Secure BGP Template Additional Information Tested on port 80 with an injected SYN/RST offset by 16 bytes. Please guide/suggest. Thanks in advance. Best Regards, Kaushal

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss